{"id":"CVE-2022-1025","published":"2022-07-12T20:39:54Z","modified":"2024-08-02T23:47:43Z","title":"All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a…","vendor":null,"product":null,"tier":"tail","description":{"text":"All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01345,"percentile":0.71371,"provenance":"source"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww","tags":["x_refsource_MISC"]}],"priority":{"score":14.3,"factors":[{"name":"EPSS percentile","points":14.27}]},"affectedVersions":[{"vendor":"n/a","product":"ArgoCD","versions":["0.5.0 through 2.1.12, 2.2.7, 2.3.1"]}],"affected":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","vulnerableRanges":[">=0.5.0, <=1.8.7",">=0.5.0"],"patched":[],"from":["GHSA-96jv-vj39-x4j6","GO-2022-0359","GO-2022-0516"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","vulnerableRanges":["<2.1.14",">=2.2.0, <2.2.8",">=2.3.0, <2.3.2"],"patched":["2.1.14","2.2.8","2.3.2"],"from":["GHSA-96jv-vj39-x4j6","GO-2022-0359","GO-2022-0516"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-6302","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-argoproj-argo-cd-cve-2020-11576","parents":[{"from":"CVE-2022-24768","to":"CVE-2022-1025","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-2f5v-8r3f-8pww","via":"reference","url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww"},{"kind":"osv-related","provenance":"source","id":"GHSA-96jv-vj39-x4j6","via":"reference","url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww"}]}],"children":[{"from":"CVE-2022-1025","to":"CVE-2022-41354","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/application/application.go"],"commits":["https://github.com/argoproj/argo-cd/commit/af03b291d4b7e9d3ce9a6580ae9c8141af0e05cf","https://github.com/argoproj/argo-cd/commit/3a28c8a18cc2aa84fe81492625545d25c7a90bc3"],"basis":"shared function","functions":["DeleteResource","ListResourceEvents","PatchResource","getAppResources"]}]},{"from":"CVE-2022-1025","to":"CVE-2024-31990","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["pkg/apis/application/v1alpha1/app_project_types.go","server/application/application.go"],"commits":["https://github.com/argoproj/argo-cd/commit/af03b291d4b7e9d3ce9a6580ae9c8141af0e05cf","https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c","https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5"],"basis":"shared function","functions":["DeleteResource","getAppResources"]}]},{"from":"CVE-2022-1025","to":"CVE-2024-32476","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["controller/appcontroller.go","controller/cache/cache.go"],"commits":["https://github.com/argoproj/argo-cd/commit/af03b291d4b7e9d3ce9a6580ae9c8141af0e05cf","https://github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657","https://github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2022-24730","published":"2022-03-23","fixed":"2.3.0","kev":false},{"cve":"CVE-2022-24731","published":"2022-03-23","fixed":"2.3.0","kev":false,"link":{"from":"CVE-2022-24731","to":"CVE-2022-1025","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v2","fromFixed":"2.1.11","toFixed":"2.1.14","daysApart":111}]}},{"cve":"CVE-2023-40026","published":"2023-09-27","fixed":"2.3.0","kev":false},{"cve":"CVE-2022-1025","published":"2022-07-12","fixed":"2.3.2","kev":false},{"cve":"CVE-2022-24768","published":"2022-03-23","fixed":"2.3.2","kev":false},{"cve":"CVE-2022-24904","published":"2022-05-20","fixed":"2.3.4","kev":false},{"cve":"CVE-2022-24905","published":"2022-05-20","fixed":"2.3.4","kev":false}],"package":"Go:github.com/argoproj/argo-cd/v2"}}