XSS in Argoproj Argo-Cd
CVE-2022-31035
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a `javascript:` link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). The script would be capable of doing anything which is possible in the UI or via the API, such as creating, modifying, and deleting Kubernetes resources. A patch for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. There are no completely-safe workarounds besides upgrading.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.009 (58.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.
Affected products
- Argoproj Argo-cd — versions >= 1.0.0, < 2.1.16, >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.5
- Argoproj Argo_cd — versions 2.2.9, 2.3.4, 2.4.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory, Mitigation)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-31035?
- CVE-2022-31035 is a critical-severity vulnerability in Argoproj Argo-Cd, classified under Cross-site Scripting. CVSS score: 9.0/10. Published 2022-06-27.
- How severe is CVE-2022-31035?
- Critical severity. CVSS v3 base score is 9.0 out of 10.
- Is CVE-2022-31035 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.