PT-2021-15451 · Argo Cd · Argo Cd

Jannfis · Published 2021-03-03 · Updated 2024-08-21 · CVE-2021-23347

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions argo-cd versions prior to 1.7.13 argo-cd versions 1.8.0 through 1.8.6

Description The issue is related to Cross-site Scripting (XSS) where a malicious SSO provider connected to Argo CD could send back a malicious error message containing JavaScript to the user. This could result in the execution of arbitrary JavaScript code on the client. The exploitation of this vulnerability is believed to be possible only when Argo CD is connected to a compromised or malicious SSO provider.

Recommendations For argo-cd versions prior to 1.7.13, update to version 1.7.14 or later. For argo-cd versions 1.8.0 through 1.8.6, update to version 1.8.7 or later. As a temporary workaround, consider not using SSO with the CLI when you don't trust your SSO provider.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-ARGO-CD-2021-23347

CVE-2021-23347

GHSA-QQ5V-F4C3-395C

GO-2022-0869

SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDCMD-1078291

Affected Products

Argo Cd

References · 13

• https://github.com/argoproj/argo-cd/pull/5563 · Patch
• https://osv.dev/vulnerability/GHSA-qq5v-f4c3-395c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23347 · Security Note
• https://osv.dev/vulnerability/GO-2022-0869 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-argo-cd-2021-23347 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23347 · Vendor Advisory
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-qq5v-f4c3-395c · Note
• https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDCMD-1078291 · Note
• https://t.me/cvenotify/10795 · Telegram Post
• https://t.me/cvenotify/10813 · Telegram Post
• https://t.me/cibsecurity/24387 · Telegram Post
• https://t.me/cvenotify/89701 · Telegram Post
• https://t.me/cvenotify/10792 · Telegram Post