CVE-2021-23347

The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.

Published: Mar 3, 2021
Updated: May 9, 2024
CVE: CVE-2021-23347
GHSA: GHSA-qq5v-f4c3-395c
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.8
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
github.com/argoproj/argo-cd/v2	-	1.7.13
github.com/argoproj/argo-cd/v2	1.8.0	1.8.6
argoproj / argo_cd	1.8.0	1.8.6
argoproj / argo_cd	-	1.7.13

https://github.com/argoproj/argo-cd/pull/5563
https://github.com/argoproj/argo-cd/security/advisories/GHSA-qq5v-f4c3-395c
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDCMD-1078291

Vulnerability Database

CVE-2021-23347