VDB
CVE-2022-24904
CVE-2022-24904
PUBLISHED
CVSS 4.300000190734863 MEDIUM
Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server
EPSS 1.15% · 66.9th percentile
Risk Scores
CVSS 3.1
4.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Score
1.15%
66.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| argoproj | argo_cd | 2.3.0, 2.2.0, 0.7.0 |
| argoproj | argo-cd | >= 0.7.0, < 2.1.15, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.4 |
| github.com | argoproj/argo-cd/v2 | 2.2.0, 2.3.0, 0 |
Timeline
- May 20, 2022 CVE Published
- May 21, 2022 EPSS Score
- Jul 10, 2022 EPSS Score
- Aug 30, 2022 EPSS Score
- Oct 18, 2022 EPSS Score
- Dec 7, 2022 EPSS Score
- Jan 26, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 17, 2023 EPSS Score
- Jun 24, 2023 EPSS Score
- Aug 13, 2023 EPSS Score
- Oct 2, 2023 EPSS Score
References
- https://github.com/argoproj/argo-cd/commit/5e767a4b9e30983330c0fdec322192281a90eb84 fix
- https://github.com/argoproj/argo-cd/commit/7357cfdb58a560de70a0538c6e3bef6fe39505ea fix
- https://github.com/argoproj/argo-cd/commit/d36d95dc9f71ec61c1a93794f81ece6d61a0d943 fix
- https://github.com/argoproj/argo-cd/releases/tag/v2.1.15 fix
- https://github.com/argoproj/argo-cd/releases/tag/v2.2.9 fix
- https://github.com/argoproj/argo-cd/releases/tag/v2.3.4 fix
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h url
- https://nvd.nist.gov/vuln/detail/CVE-2022-24904 advisory
- github.com/argoproj/argo-cd package