CVE-2022-24905

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was found in Argo CD prior to versions 2.3.4, 2.2.9, and 2.1.15 that allows an attacker to spoof error messages on the login screen when single sign on (SSO) is enabled. In order to exploit this vulnerability, an attacker would have to trick the victim to visit a specially crafted URL which contains the message to be displayed. As far as the research of the Argo CD team concluded, it is not possible to specify any active content (e.g. Javascript) or other HTML fragments (e.g. clickable links) in the spoofed message. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. There are currently no known workarounds.

CVSS v3 4.3 MEDIUM
CVSS v2.0 2.6 LOW

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/argoproj/argo-cd/releases/tag/v2.1.15	Release Notes Third Party Advisory
https://github.com/argoproj/argo-cd/releases/tag/v2.2.9	Release Notes Third Party Advisory
https://github.com/argoproj/argo-cd/releases/tag/v2.3.4	Release Notes Third Party Advisory
https://github.com/argoproj/argo-cd/security/advisories/GHSA-xmg8-99r8-jc2j	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:linuxfoundation:argo-cd::::::::
	cpe:2.3:a:linuxfoundation:argo-cd::::::::
	cpe:2.3:a:linuxfoundation:argo-cd::::::::

History

No history.

Information

Published : 2022-05-20 14:15

Updated : 2022-06-06 13:21

NVD link : CVE-2022-24905

Mitre link : CVE-2022-24905

CVE.ORG link : CVE-2022-24905

JSON object : View

Products Affected

linuxfoundation

argo-cd

CWE

NVD-CWE-noinfo CWE-20

Improper Input Validation

{"id": "CVE-2022-24905", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2022-05-20T14:15:09.360", "references": [{"url": "https://github.com/argoproj/argo-cd/releases/tag/v2.1.15", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/argoproj/argo-cd/releases/tag/v2.2.9", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/argoproj/argo-cd/releases/tag/v2.3.4", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-xmg8-99r8-jc2j", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was found in Argo CD prior to versions 2.3.4, 2.2.9, and 2.1.15 that allows an attacker to spoof error messages on the login screen when single sign on (SSO) is enabled. In order to exploit this vulnerability, an attacker would have to trick the victim to visit a specially crafted URL which contains the message to be displayed. As far as the research of the Argo CD team concluded, it is not possible to specify any active content (e.g. Javascript) or other HTML fragments (e.g. clickable links) in the spoofed message. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. There are currently no known workarounds."}, {"lang": "es", "value": "Argo CD es una herramienta declarativa de entrega continua GitOps para Kubernetes. Se encontr\u00f3 una vulnerabilidad en Argo CD En versiones anteriores a 2.3.4, 2.2.9 y 2.1.15 que permite a un atacante falsificar los mensajes de error en la pantalla de inicio de sesi\u00f3n cuando el inicio de sesi\u00f3n \u00fanico (SSO) est\u00e1 habilitado. Para explotar esta vulnerabilidad, un atacante tendr\u00eda que enga\u00f1ar a la v\u00edctima para que visite una URL especialmente dise\u00f1ada que contenga el mensaje a mostrar. Seg\u00fan las investigaciones del equipo de CD de Argo, no es posible especificar ning\u00fan contenido activo (por ejemplo, Javascript) ni otros fragmentos de HTML (por ejemplo, enlaces en los que pueda hacerse clic) en el mensaje falsificado. Ha sido publicado un parche para esta vulnerabilidad en las versiones 2.3.4, 2.2.9 y 2.1.15 de Argo CD. En la actualidad no se conocen mitigaciones"}], "lastModified": "2022-06-06T13:21:16.997", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:argo-cd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "82BCBA19-E9AB-44B5-9C39-7AB75A33D29D", "versionEndExcluding": "2.1.15", "versionStartIncluding": "0.6.1"}, {"criteria": "cpe:2.3:a:linuxfoundation:argo-cd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C51A2B60-2CE4-423F-AB5A-2653BBD12958", "versionEndExcluding": "2.2.9", "versionStartIncluding": "2.2.0"}, {"criteria": "cpe:2.3:a:linuxfoundation:argo-cd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77918123-8079-42F2-A71B-8CC6D3BA8057", "versionEndExcluding": "2.3.4", "versionStartIncluding": "2.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}