CVE-2022-31035: fallo crítico en argoproj argo-cd
External URLs for Deployments can include javascript in argo-cd
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9epss 1.0%
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a `javascript:` link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). The script would be capable of doing anything which is possible in the UI or via the API, such as creating, modifying, and deleting Kubernetes resources. A patch for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. There are no completely-safe workarounds besides upgrading.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Productos afectados
argoproj · argo-cdCVEs relacionadas — argoproj argo-cd
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-59538HIGHArgo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhookEPSS 10.6%CVE-2025-55190CRITICALArgo CD: Project API Token Exposes Repository CredentialsEPSS 5.7%CVE-2024-37152MEDIUMUnauthenticated Access to sensitive settings in Argo CDEPSS 2.3%CVE-2022-29165CRITICALArgo CD will blindly trust JWT claims if anonymous access is enabledEPSS 2.1%CVE-2026-55797HIGHArgo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URLEPSS 1.9%CVE-2024-31989CRITICALArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis CacheEPSS 1.5%