CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2022-41354
An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
- CWE
- CWE-203
- Published
- Modified
- Record from
- the NVD, synced
Affected
- linuxfoundation:argo-cd
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2q5c-qw9c-fmvq | Go | github.com/argoproj/argo-cd | >=0.5.0 <=1.8.7 | no fix published |
| GHSA-2q5c-qw9c-fmvq | Go | github.com/argoproj/argo-cd/v2 | >=2.5.0 <2.5.16 | 2.5.16 |
| GHSA-2q5c-qw9c-fmvq | Go | github.com/argoproj/argo-cd/v2 | >=2.6.0 <2.6.7 | 2.6.7 |
| GHSA-2q5c-qw9c-fmvq | Go | github.com/argoproj/argo-cd/v2 | <2.4.28 | 2.4.28 |
| GO-2023-1670 | Go | github.com/argoproj/argo-cd | >=0.5.0 | no fix published |
| GO-2023-1670 | Go | github.com/argoproj/argo-cd/v2 | <2.4.28 >=2.5.0 <2.5.16 >=2.6.0 <2.6.7 | 2.4.28, 2.5.16, 2.6.7 |
References
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-2q5c-qw9c-fmvq
- https://github.com/chunklhit/cve/blob/master/argo/argo-cd/application_enumeration.md
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-2q5c-qw9c-fmvq
- https://github.com/chunklhit/cve/blob/master/argo/argo-cd/application_enumeration.md