PT-2024-24340 · Argo Cd · Argo Cd

Crenshaw-Dev · Published 2024-04-15 · Updated 2025-01-09 · CVE-2024-31990

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Argo CD versions prior to 2.10.7 Argo CD versions prior to 2.9.12 Argo CD versions prior to 2.8.16

Description Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces, which allows attackers to use the UI to edit resources that should only be mutable via gitops. An attacker can exploit this by creating an Application in a specific namespace, changing its project, and then using the UI to edit the resource.

Recommendations For versions prior to 2.10.7, update to version 2.10.7 or later. For versions prior to 2.9.12, update to version 2.9.12 or later. For versions prior to 2.8.16, update to version 2.8.16 or later. As a temporary workaround, consider restricting access to the UI for editing resources to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-ARGO-CD-2024-31990

CVE-2024-31990

GHSA-2GVW-W6FJ-7M3C

GO-2024-2728

Affected Products

Argo Cd

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31990.json · Exploit
• https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c · Patch
• https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17 · Patch
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c · Vendor Advisory
• https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5 · Patch
• https://osv.dev/vulnerability/GO-2024-2728 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-argo-cd-2024-31990 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2gvw-w6fj-7m3c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31990 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31990 · Security Note
• https://github.com/argoproj/argo-cd · Note
• https://t.me/cvenotify/76864 · Telegram Post
• https://twitter.com/CVEnew/status/1779966910068568375 · Twitter Post
• https://t.me/cvenotify/76933 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1780007990680080734 · Twitter Post