Chainargoproj · argo-cdGo:github.com/argoproj/argo-cd
argoproj argo-cd: related fixes (2020–2024)
16 CVEs over 5 generations, 8 Apr 2020 to 24 Jul 2024.
Family tree
Left to right by publication date.Oldest first. Select a CVE to open it.- CVE-2020-115768 Apr 2020 First in the chain
- CVE-2020-88278 Apr 2020 next fix after CVE-2018-21034
- CVE-2018-210349 Apr 2020 No direct link to an earlier CVE
- CVE-2022-2476823 Mar 2022 No direct link to an earlier CVE
- CVE-2022-102512 Jul 2022 related to CVE-2022-24768
- CVE-2022-4135427 Mar 2023 related to CVE-2018-21034related to CVE-2022-24768and 1 more
- CVE-2023-4002523 Aug 2023 next fix after CVE-2022-41354
- CVE-2024-2242419 Jan 2024 related to CVE-2023-40025
- CVE-2023-5072613 Mar 2024 next fix after CVE-2024-22424
- CVE-2024-2165218 Mar 2024 next fix after CVE-2023-50726
- CVE-2024-2166118 Mar 2024 related to CVE-2020-11576related to CVE-2020-8827and 4 more
- CVE-2024-2166218 Mar 2024 related to CVE-2024-21652related to CVE-2024-21661and 1 more
- CVE-2024-3199015 Apr 2024 related to CVE-2018-21034related to CVE-2022-24768and 5 more
- CVE-2024-3247626 Apr 2024 related to CVE-2022-24768related to CVE-2022-1025and 2 more
- CVE-2024-4063422 Jul 2024 related to CVE-2023-40025related to CVE-2024-22424and 1 more
- CVE-2024-4166624 Jul 2024 related to CVE-2023-40025related to CVE-2024-21661and 1 more
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVEs in this family
Table view of the tree| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2020-11576 | 8 Apr 2020 | Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to… · fixed in 1.5.1 | First in chain | 16.1 |
| CVE-2020-8827 | 8 Apr 2020 | As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or… · fixed in 1.5.1 | CVE-2018-21034 · Next fix in the same package · Low | 16.5 |
| CVE-2018-21034 | 9 Apr 2020 | In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve… · fixed in 1.5.0-rc1 | First in chain | 14.4 |
| CVE-2022-24768 | 23 Mar 2022 | Improper access control allows admin privilege escalation in Argo CD · fixed in 2.3.2 | First in chain | 20.8 |
| CVE-2022-1025 | 12 Jul 2022 | All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a… · fixed in 2.3.2 | CVE-2022-24768 · related · High | 14.3 |
| CVE-2022-41354 | 27 Mar 2023 | An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications · fixed in 2.6.7 | CVE-2018-21034 · related · Medium | 10.2 |
| CVE-2023-40025 | 23 Aug 2023 | Argo CD web terminal session doesn't expire · fixed in 2.8.1 | CVE-2022-41354 · Next fix in the same package · High | 12.8 |
| CVE-2024-22424 | 19 Jan 2024 | Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd · fixed in 2.10-rc2 | CVE-2023-40025 · related · Medium | 14.2 |
| CVE-2023-50726 | 13 Mar 2024 | Users with `create` but not `override` privileges can perform local sync in argo-cd · fixed in 2.10.3 | CVE-2024-22424 · Next fix in the same package · Low | 13.5 |
| CVE-2024-21652 | 18 Mar 2024 | Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss · fixed in 2.10.4 | CVE-2023-50726 · Next fix in the same package · Low | 17.8 |
| CVE-2024-21661 | 18 Mar 2024 | Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment · fixed in 2.10.4 | CVE-2020-11576 · related · Medium | 18.8 |
| CVE-2024-21662 | 18 Mar 2024 | Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow · fixed in 2.10.4 | CVE-2024-21652 · related · High | 16.8 |
| CVE-2024-31990 | 15 Apr 2024 | Argo CD' API server does not enforce project sourceNamespaces · fixed in 2.10.7 | CVE-2018-21034 · related · Medium | 11.1 |
| CVE-2024-32476 | 26 Apr 2024 | Denial of Service via malicious jqPathExpressions in ignoreDifferences · fixed in 2.10.8 | CVE-2022-24768 · related · Medium | 17.1 |
| CVE-2024-40634 | 22 Jul 2024 | Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint · fixed in 2.11.6 | CVE-2023-40025 · related · Medium | 19.7 |
| CVE-2024-41666 | 24 Jul 2024 | The Argo CD web terminal session does not handle the revocation of user permissions properly. · fixed in 2.11.7 | CVE-2023-40025 · related · Medium | 13.8 |