XSS in Argoproj Argo-Cd
CVE-2022-31102
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with 2.3.0 and prior to 2.3.6 and 2.4.5 is vulnerable to a cross-site scripting (XSS) bug which could allow an attacker to inject arbitrary JavaScript in the `/auth/callback` page in a victim's browser. This vulnerability only affects Argo CD instances which have single sign on (SSO) enabled. The exploit also assumes the attacker has 1) access to the API server's encryption key, 2) a method to add a cookie to the victim's browser, and 3) the ability to convince the victim to visit a malicious `/auth/callback` link. The vulnerability is classified as low severity because access to the API server's encryption key already grants a high level of access. Exploiting the XSS would allow the attacker to impersonate the victim, but would not grant any privileges which the attacker could not otherwise gain using the encryption key. A patch for this vulnerability has been released in the following Argo CD versions 2.4.5 and 2.3.6. There is currently no known workaround.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 2.6 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.006 (48.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 48.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000
Affected products
- Argoproj Argo-Cd — versions >= 2.3.0, < 2.3.6, >= 2.4.0, < 2.4.5
- Argoproj Argo Cd
Weakness classification (CWE)
References
- github.com/argoproj/argo-cd/releases/tag/v2.3.6 (Third Party Advisory, Release Notes)
- github.com/argoproj/argo-cd/releases/tag/v2.4.5 (Third Party Advisory, Release Notes)
- github.com/argoproj/argo-cd/security/advisories/GHSA-pmjg-52h9-72qv (Third Party Advisory)
Frequently asked questions
- What is CVE-2022-31102?
- CVE-2022-31102 is a low-severity vulnerability in Argoproj Argo-Cd, classified under Cross-site Scripting. CVSS score: 2.6/10. Published 2022-07-12.
- How severe is CVE-2022-31102?
- Low severity. CVSS v3 base score is 2.6 out of 10.