Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-31990

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.

Published

2024-04-15T20:15:11.127

Last Modified

2025-01-09T17:04:35.590

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 4.8 (MEDIUM)

Weaknesses

Type: Secondary
CWE-863
Type: Primary
CWE-863

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	argoproj	argo_cd	< 2.8.16	Yes
Application	argoproj	argo_cd	< 2.9.12	Yes
Application	argoproj	argo_cd	< 2.10.7	Yes

References

https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c Patch ([email protected])
https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5 Patch ([email protected])
https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17 Patch ([email protected])
https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c Vendor Advisory ([email protected])
https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5 Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17 Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)