The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReader).Read() API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory name such as ...
References
| Link | Resource |
|---|---|
| https://github.com/argoproj/argo-events/commit/d0f66dbce78bc31923ca057b20fc722aa24ca961 | Patch Third Party Advisory |
| https://github.com/argoproj/argo-events/issues/1947 | Exploit Issue Tracking Third Party Advisory |
| https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOEVENTSSENSORSARTIFACTS-2864522 | Exploit Patch Third Party Advisory |
Configurations
History
08 Aug 2023, 14:21
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-59 |
28 Jun 2022, 14:54
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 | |
| CPE | cpe:2.3:a:argo_events_project:argo_events:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| References | (CONFIRM) https://github.com/argoproj/argo-events/issues/1947 - Exploit, Issue Tracking, Third Party Advisory | |
| References | (CONFIRM) https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOEVENTSSENSORSARTIFACTS-2864522 - Exploit, Patch, Third Party Advisory | |
| References | (CONFIRM) https://github.com/argoproj/argo-events/commit/d0f66dbce78bc31923ca057b20fc722aa24ca961 - Patch, Third Party Advisory |
17 Jun 2022, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-06-17 20:15
Updated : 2024-02-04 22:29
NVD link : CVE-2022-25856
Mitre link : CVE-2022-25856
CVE.ORG link : CVE-2022-25856
JSON object : View
Products Affected
argo_events_project
- argo_events