PT-2022-10470 · Argo Cd · Argo Cd

Doran Moppert · Published 2022-02-16 · Updated 2024-08-07 · CVE-2021-3557

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions argocd (affected versions not specified)

Description A flaw was found in argocd, allowing any unprivileged user to deploy argocd in their namespace. With the created ServiceAccount argocd-argocd-server, the unprivileged user can read all resources of the cluster, including all secrets, which might enable privilege escalations. The highest threat from this issue is to data confidentiality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-3557

Affected Products

Argo Cd

References · 5

• https://osv.dev/vulnerability/CVE-2021-3557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3557 · Security Note
• https://t.me/cvenotify/89706 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=1961929 · Note
• https://t.me/cibsecurity/37606 · Telegram Post