CVE-2022-31036: falha de média gravidade em argoproj argo-cd
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.9%
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file. Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server. Patches for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. If you are using a version >=v2.3.0 and do not have any Helm-type Applications you may disable the Helm config management tool as a workaround.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
argoproj · argo-cdCVEs relacionadas — argoproj argo-cd
No mesmo produto, das mais perigosas para as menos.
CVE-2025-59538HIGHArgo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhookEPSS 10.6%CVE-2025-55190CRITICALArgo CD: Project API Token Exposes Repository CredentialsEPSS 5.7%CVE-2024-37152MEDIUMUnauthenticated Access to sensitive settings in Argo CDEPSS 2.3%CVE-2026-55797HIGHArgo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URLEPSS 2.2%CVE-2022-29165CRITICALArgo CD will blindly trust JWT claims if anonymous access is enabledEPSS 2.1%CVE-2024-31989CRITICALArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis CacheEPSS 1.5%