Database/Container, Kubernetes & orchestration
Argo CD: Improper URL protocol filtering in link annotations enables client-side attacks against admins
CVSS 9.0CVE-2024-28175Container, Kubernetes & orchestrationcurated
Impact
Improper URL protocol filtering in link annotations enables client-side attacks against admins
Who can reach it
Any user who can annotate an Application
What to do
Rolling Argo CD upgrade
References
Related entries
- Argo CD: An unprivileged pod in any namespace can reach the unauthenticated Argo CD Redis on 6379 and poisonCVE-2024-31989 · Argo CDCritical
- Argo CD: Improper access control lets any user escalate to admin-levelCVE-2022-1025 · Argo CDHigh
- Argo CD: Authorization bypass lets an Application be synced to a destination it is not permitted to reachCVE-2023-22736 · Argo CDHigh
- Argo CD: Predictable SSO state values allow authentication bypass during loginCVE-2022-31034 · Argo CDHigh
- Argo CD: Improper certificate validation lets Argo CD be tricked into trusting a hostile endpointCVE-2022-31105 · Argo CDHigh
- Argo CD: CSRF against the Argo CD API allows deploying arbitrary workloads with Argo's cluster-admin rightsCVE-2024-22424 · Argo CDHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.