cve.bz

CVE-2021-23347

4.8 mediumEPSS 0.6%

Medium (4.8) in argoproj argo cd. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in github.com/argoproj/argo-cd/v2 1.7.13, 1.8.6.

The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.

Severity

CVSS 3.1

4.8 medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS
0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-qq5v-f4c3-395cGogithub.com/argoproj/argo-cd/v2<1.7.131.7.13
GHSA-qq5v-f4c3-395cGogithub.com/argoproj/argo-cd/v2>=1.8.0 <1.8.61.8.6
GO-2022-0869Gogithub.com/argoproj/argo-cd<1.7.13
>=1.8.0 <1.8.6		1.7.13, 1.8.6

References

Check your stackJSON