{"containers": {"cna": {"affected": [{"product": "argo-cd", "vendor": "argoproj", "versions": [{"status": "affected", "version": ">= 1.5.0, < 2.1.11"}, {"status": "affected", "version": ">= 2.2.0, < 2.2.6"}, {"status": "affected", "version": ">= 2.3.0-rc1, < 2.3.0"}]}], "descriptions": [{"lang": "en", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file's contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from another Application's source repositories or any secrets which have been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The problem can be mitigated by avoiding storing secrets in git, avoiding mounting secrets as files on the repo-server, avoiding decrypting secrets into files on the repo-server, and carefully limiting who can `create` or `update` Applications."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-03-23T21:00:14", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28"}], "source": {"advisory": "GHSA-h6h5-6fmq-rh28", "discovery": "UNKNOWN"}, "title": "Path traversal allows leaking out-of-bound files from Argo CD repo-server", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-24731", "STATE": "PUBLIC", "TITLE": "Path traversal allows leaking out-of-bound files from Argo CD repo-server"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "argo-cd", "version": {"version_data": [{"version_value": ">= 1.5.0, < 2.1.11"}, {"version_value": ">= 2.2.0, < 2.2.6"}, {"version_value": ">= 2.3.0-rc1, < 2.3.0"}]}}]}, "vendor_name": "argoproj"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file's contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from another Application's source repositories or any secrets which have been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The problem can be mitigated by avoiding storing secrets in git, avoiding mounting secrets as files on the repo-server, avoiding decrypting secrets into files on the repo-server, and carefully limiting who can `create` or `update` Applications."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"description": [{"lang": "eng", "value": "CWE-284: Improper Access Control"}]}]}, "references": {"reference_data": [{"name": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28", "refsource": "CONFIRM", "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28"}]}, "source": {"advisory": "GHSA-h6h5-6fmq-rh28", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:20:50.444Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-24731", "datePublished": "2022-03-23T21:00:14", "dateReserved": "2022-02-10T00:00:00", "dateUpdated": "2024-08-03T04:20:50.444Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*", "matchCriteriaId": "33244919-0218-4927-8E76-6059BB9909A6", "versionEndExcluding": "2.1.11", "versionStartIncluding": "1.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*", "matchCriteriaId": "3BF852EA-7214-413B-9E72-DFB0165067B6", "versionEndExcluding": "2.2.6", "versionStartIncluding": "2.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:argoproj:argo_cd:2.3.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "6FA0E90D-79C0-4F34-8FB5-061073BCEEA7", "vulnerable": true}, {"criteria": "cpe:2.3:a:argoproj:argo_cd:2.3.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "794935A2-5EF6-4514-9B2B-D06AF10B2EA3", "vulnerable": true}, {"criteria": "cpe:2.3:a:argoproj:argo_cd:2.3.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "401CAF1A-8BCC-446F-8C4D-53753BAC8BDA", "vulnerable": true}, {"criteria": "cpe:2.3:a:argoproj:argo_cd:2.3.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "FBD86381-9064-4D50-B740-81E6680C6131", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file's contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from another Application's source repositories or any secrets which have been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The problem can be mitigated by avoiding storing secrets in git, avoiding mounting secrets as files on the repo-server, avoiding decrypting secrets into files on the repo-server, and carefully limiting who can `create` or `update` Applications."}, {"lang": "es", "value": "Argo CD es una herramienta declarativa de entrega continua GitOps para Kubernetes. Argo CD a partir de la versi\u00f3n 1.5.0 pero antes de las versiones 2.1.11, 2.2.6 y 2.3.0 es susceptible a una vulnerabilidad de salto de ruta, que permite a un usuario malicioso con acceso de lectura/escritura filtrar archivos confidenciales desde el repo-servidor de Argo CD. Un usuario malicioso de Argo CD al que le haya sido concedido acceso \"create\" o \"update\" aplicaciones puede filtrar el contenido de cualquier archivo de texto en el servidor de repositorios. Al dise\u00f1ando un gr\u00e1fico Helm malicioso y us\u00e1ndolo en una Aplicaci\u00f3n, el atacante puede recuperar el contenido del archivo confidencial como parte de los manifiestos generados o en un mensaje de error. El atacante tendr\u00eda que conocer o adivinar la ubicaci\u00f3n del archivo objetivo. Los archivos confidenciales que podr\u00edan filtrarse incluyen archivos de los repositorios de origen de otra aplicaci\u00f3n o cualquier secreto que haya sido montado como archivo en el servidor de repositorios. Esta vulnerabilidad est\u00e1 parcheada en las versiones 2.1.11, 2.2.6 y 2.3.0 de Argo CD. El problema puede ser mitigado al evitar almacenar secretos en git, evitando montar secretos como archivos en el servidor de repo, evitando descifrar secretos en archivos en el servidor de repo, y limitando cuidadosamente qui\u00e9n puede \"create\" o \"update\" Aplicaciones"}], "id": "CVE-2022-24731", "lastModified": "2024-08-07T15:43:51.540", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2022-03-23T21:15:08.083", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-209"}, {"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2022:1039", "cpe": "cpe:/a:redhat:openshift_gitops:1.2::el8", "package": "openshift-gitops-1/argocd-rhel8:v1.2.3-3", "product_name": "Red Hat OpenShift GitOps 1.2", "release_date": "2022-03-23T00:00:00Z"}, {"advisory": "RHSA-2022:1040", "cpe": "cpe:/a:redhat:openshift_gitops:1.3::el8", "package": "openshift-gitops-1/argocd-rhel8:v1.3.5-4", "product_name": "Red Hat OpenShift GitOps 1.3", "release_date": "2022-03-23T00:00:00Z"}, {"advisory": "RHSA-2022:1042", "cpe": "cpe:/a:redhat:openshift_gitops:1.3::el8", "package": "openshift-gitops-1/argocd-rhel8:v1.3.6-3", "product_name": "Red Hat OpenShift GitOps 1.3", "release_date": "2022-03-23T00:00:00Z"}, {"advisory": "RHSA-2022:1041", "cpe": "cpe:/a:redhat:openshift_gitops:1.4::el8", "package": "openshift-gitops-1/argocd-rhel8:v1.4.4-6", "product_name": "Red Hat OpenShift GitOps 1.4", "release_date": "2022-03-23T00:00:00Z"}], "bugzilla": {"description": "argocd: path traversal allows leaking out-of-bound files", "id": "2062755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2062755"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-22->CWE-209", "details": ["Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file's contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from another Application's source repositories or any secrets which have been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The problem can be mitigated by avoiding storing secrets in git, avoiding mounting secrets as files on the repo-server, avoiding decrypting secrets into files on the repo-server, and carefully limiting who can `create` or `update` Applications.", "A path traversal flaw was found in ArgoCD. This flaw allows an attacker who has been granted create or update access to applications to leak the contents of any text file on the repo-server by crafting a malicious Helm chart. Such text files could include sensitive information that the attacker should not have access to, compromising data confidentiality."], "name": "CVE-2022-24731", "public_date": "2022-03-22T17:15:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-24731\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-24731"], "threat_severity": "Important", "upstream_fix": "argocd 2.3.0, argocd 2.2.6, argocd 2.1.11"}