Vulnerability CVE-2022-1025


Published: 2022-07-12

Description:
All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.

Type:

CWE-863

(Incorrect Authorization)

CVSS2 => (AV:N/AC:L/Au:S/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9/10
10/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Linuxfoundation -> Argo-cd 

 References:
https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww

Copyright 2024, cxsecurity.com

 

Back to Top