VDB
CVE-2021-3557
CVE-2021-3557
PUBLISHED
CVSS 6.5 MEDIUM
A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster including all secrets which might enable privilege escalations. The highest threat from this vulnerability is to data confidentiality.
EPSS 0.76% · 55.1th percentile
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.76%
55.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| redhat | openshift_gitops | 1.1 |
| argoproj | argo_cd | 0 |
| n/a | argocd | * |
Timeline
- Feb 16, 2022 CVE Published
- Feb 17, 2022 EPSS Score
- Apr 11, 2022 EPSS Score
- Jun 3, 2022 EPSS Score
- Jul 27, 2022 EPSS Score
- Sep 18, 2022 EPSS Score
- Nov 11, 2022 EPSS Score
- Jan 3, 2023 EPSS Score
- Feb 25, 2023 EPSS Score
- Apr 19, 2023 EPSS Score
- Jun 11, 2023 EPSS Score
- Aug 3, 2023 EPSS Score