CVSS 3.1
7.7 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NCVE-2022-24348
High (7.7) in argoproj argo cd. EPSS 2.8% chance of exploitation in the next 30 days. Fixed in github.com/argoproj/argo-cd/v2 2.1.9, 2.2.4.
Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.
Severity
- EPSS
- 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- argoproj:argo_cd
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-63qx-x74g-jcr7 | Go | github.com/argoproj/argo-cd/v2 | <2.1.9 | 2.1.9 |
| GHSA-63qx-x74g-jcr7 | Go | github.com/argoproj/argo-cd/v2 | >=2.2.0 <2.2.4 | 2.2.4 |
| GHSA-63qx-x74g-jcr7 | Go | github.com/argoproj/argo-cd | <2.1.9 | 2.1.9 |
| GO-2022-0304 | Go | github.com/argoproj/argo-cd | all versions | no fix published |
| GO-2022-0304 | Go | github.com/argoproj/argo-cd/v2 | <2.1.9 >=2.2.0 <2.2.4 | 2.1.9, 2.2.4 |
References
- https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments/
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7
- https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments/
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7