CVE-2022-31102
published 2022-07-12CVE-2022-31102: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with 2.3.0 and prior to 2.3.6 and 2.4.5 is vulnerable to a…
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.50%
39.0th percentile
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with 2.3.0 and prior to 2.3.6 and 2.4.5 is vulnerable to a cross-site scripting (XSS) bug which could allow an attacker to inject arbitrary JavaScript in the `/auth/callback` page in a victim's browser. This vulnerability only affects Argo CD instances which have single sign on (SSO) enabled. The exploit also assumes the attacker has 1) access to the API server's encryption key, 2) a method to add a cookie to the victim's browser, and 3) the ability to convince the victim to visit a malicious `/auth/callback` link. The vulnerability is classified as low severity because access to the API server's encryption key already grants a high level of access. Exploiting the XSS would allow the attacker to impersonate the victim, but would not grant any privileges which the attacker could not otherwise gain using the encryption key. A patch for this vulnerability has been released in the following Argo CD versions 2.4.5 and 2.3.6. There is currently no known workaround.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| argoproj | argo-cd | — | — |
| argoproj | argo-cd | — | — |
| argoproj | argo_cd | >= 2.3.0 < 2.3.6 | 2.3.6 |
| argoproj | argo_cd | >= 2.4.0 < 2.4.5 | 2.4.5 |
| github.com | argoproj_argo-cd | >= 2.3.0 < 2.3.6 | 2.3.6 |
| github.com | argoproj_argo-cd | >= 2.4.0 < 2.4.5 | 2.4.5 |
| github.com | argoproj_argo-cd_v2 | >= 2.3.0 < 2.3.6 | 2.3.6 |
| github.com | argoproj_argo-cd_v2 | >= 2.4.0 < 2.4.5 | 2.4.5 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Argo CD SSO users vulnerable to Cross-site Scripting in github.com/argoproj/argo-cd
osv·2024-08-21
CVE-2022-31102 Argo CD SSO users vulnerable to Cross-site Scripting in github.com/argoproj/argo-cd
Argo CD SSO users vulnerable to Cross-site Scripting in github.com/argoproj/argo-cd
Argo CD SSO users vulnerable to Cross-site Scripting in github.com/argoproj/argo-cd
GHSA
Argo CD SSO users vulnerable to Cross-site Scripting
ghsa·2022-07-12
CVE-2022-31102 [LOW] CWE-79 Argo CD SSO users vulnerable to Cross-site Scripting
Argo CD SSO users vulnerable to Cross-site Scripting
### Impact
All versions of Argo CD starting with 2.3.0 are vulnerable to a cross-site scripting (XSS) bug which could allow an attacker to inject arbitrary JavaScript in the `/auth/callback` page in a victim's browser.
This vulnerability only affects Argo CD instances which have SSO enabled.
The exploit also assumes the attacker has 1) access to the API server's encryption key, 2) a method to add a cookie to the victim's browser, and 3) the ability to convince the victim to visit a malicious `/auth/callback` link.
The vulnerability is classified as low severity, because access to the API server's encryption key already grants a high level of access. Exploiting the XSS would allow the attacker to impersonate the victim, but would not
OSV
Argo CD SSO users vulnerable to Cross-site Scripting
osv·2022-07-12
CVE-2022-31102 [LOW] Argo CD SSO users vulnerable to Cross-site Scripting
Argo CD SSO users vulnerable to Cross-site Scripting
### Impact
All versions of Argo CD starting with 2.3.0 are vulnerable to a cross-site scripting (XSS) bug which could allow an attacker to inject arbitrary JavaScript in the `/auth/callback` page in a victim's browser.
This vulnerability only affects Argo CD instances which have SSO enabled.
The exploit also assumes the attacker has 1) access to the API server's encryption key, 2) a method to add a cookie to the victim's browser, and 3) the ability to convince the victim to visit a malicious `/auth/callback` link.
The vulnerability is classified as low severity, because access to the API server's encryption key already grants a high level of access. Exploiting the XSS would allow the attacker to impersonate the victim, but would not
Red Hat
argo-cd: leaked API server encryption key can allow XSS for SSO users
vendor_redhat·2022-07-13·CVSS 2.6
CVE-2022-31102 [LOW] CWE-79 argo-cd: leaked API server encryption key can allow XSS for SSO users
argo-cd: leaked API server encryption key can allow XSS for SSO users
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with 2.3.0 and prior to 2.3.6 and 2.4.5 is vulnerable to a cross-site scripting (XSS) bug which could allow an attacker to inject arbitrary JavaScript in the `/auth/callback` page in a victim's browser. This vulnerability only affects Argo CD instances which have single sign on (SSO) enabled. The exploit also assumes the attacker has 1) access to the API server's encryption key, 2) a method to add a cookie to the victim's browser, and 3) the ability to convince the victim to visit a malicious `/auth/callback` link. The vulnerability is classified as low severity because access to the API server's encryption key already grants a hi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/argoproj/argo-cd/releases/tag/v2.3.6https://github.com/argoproj/argo-cd/releases/tag/v2.4.5https://github.com/argoproj/argo-cd/security/advisories/GHSA-pmjg-52h9-72qvhttps://github.com/argoproj/argo-cd/releases/tag/v2.3.6https://github.com/argoproj/argo-cd/releases/tag/v2.4.5https://github.com/argoproj/argo-cd/security/advisories/GHSA-pmjg-52h9-72qv
2022-07-12
Published