What is CVE-2023-23947?

CVE-2023-23947 is a critical-severity vulnerability in Argoproj Argo-cd, classified under Incorrect Authorization. CVSS score: 9.1/10. Published 2023-02-16.

How severe is CVE-2023-23947?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Is CVE-2023-23947 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Argoproj Argo-cd

CVE-2023-23947

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All Argo CD versions starting with 2.3.0-rc1 and prior to 2.3.17, 2.4.23 2.5.11, and 2.6.2 are vulnerable to an improper authorization bug which allows users who ha…

Vulnerability class: Broken Access Control

EPSS: 0.004 (58.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Argoproj Argo-cd — versions >= 2.3.0-rc1, < 2.3.17, >= 2.4.0, < 2.4.23, >= 2.5.0, < 2.5.11

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

https://github.com/argoproj/argo-cd/security/advisories/GHSA-3jfq-742w-xg8j (x_refsource_CONFIRM)
https://github.com/argoproj/argo-cd/commit/fbb0b99b1ac3361b253052bd30259fa43a520945 (x_refsource_MISC)

Frequently asked questions

What is CVE-2023-23947?: CVE-2023-23947 is a critical-severity vulnerability in Argoproj Argo-cd, classified under Incorrect Authorization. CVSS score: 9.1/10. Published 2023-02-16.
How severe is CVE-2023-23947?: Critical severity. CVSS v3 base score is 9.1 out of 10.
Is CVE-2023-23947 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.