CVE-2024-31990

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-31990
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c Patch
https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5 Patch
https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17 Patch
https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c Vendor Advisory
https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c Patch
https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5 Patch
https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17 Patch
https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
History

09 Jan 2025, 17:04

Type Values Removed Values Added
First Time Argoproj
Argoproj argo Cd
CPE cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
References () https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c - () https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c - Patch
References () https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5 - () https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5 - Patch
References () https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17 - () https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17 - Patch
References () https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c - () https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c - Vendor Advisory

21 Nov 2024, 09:14

Type Values Removed Values Added
References () https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c - () https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c -
References () https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5 - () https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5 -
References () https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17 - () https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17 -
References () https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c - () https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c -

16 Apr 2024, 13:24

Type Values Removed Values Added
Summary
  • (es) Argo CD es una herramienta declarativa de entrega continua de GitOps para Kubernetes. El servidor API no aplica los espacios de nombres de origen del proyecto, lo que permite a los atacantes usar la interfaz de usuario para editar recursos que solo deberían poder modificarse a través de gitops. Esta vulnerabilidad se corrigió en 2.10.7, 2.9.12 y 2.8.16.

15 Apr 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-15 20:15

Updated : 2025-01-09 17:04

NVD link : CVE-2024-31990

Mitre link : CVE-2024-31990

CVE.ORG link : CVE-2024-31990

JSON object : View

Products Affected

argoproj

  • argo_cd
CWE
CWE-863

Incorrect Authorization