CVE-2022-1025: argoproj argo_cd
CVSS: 9.0v2.0HighModified
AliasesGHSA-2f5v-8r3f-8pwwCVE-2022-24768GHSA-96jv-vj39-x4j6GO-2022-0359GO-2022-0516
Published 12-07-2022Last modified 02-08-2024
Vulnerability summary
CVE-2022-1025 is a high (CVSS 9.0) vulnerability in argoproj argo_cd. EPSS estimates a 1.34% chance of exploitation in the next 30 days, higher than 70.9% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.0/10
010
High · v2.0 (NVD)EPSS score
1.34%
0%100%
Low · +0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Timeline
- 12-07-2022PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 8.8Preferred score · OSV · Go (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
High 9.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
1.34%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
+0.04 pp
From 1.31% on 19-09-2026
19-09-202619-10-2026
EPSS score1.34%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundArgo Cd
Maturity: poc
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Affected systems
Argoproj1 product
- argo_cd≥ 0.5.0, < 2.1.14 | ≥ 2.2.0, < 2.2.8 | ≥ 2.3.0, < 2.3.2 | ≥ 0.5.0, ≤ 2.1.12 | ≥ 2.2.0, ≤ 2.2.7 | ≥ 2.3.0, ≤ 2.3.1
Github.com/argoproj1 product
- argo-cd≥ 0.5.0, < 2.1.14 | ≥ 2.2.0, < 2.2.8 | ≥ 2.3.0, < 2.3.2 | ≥ 0.5.0, ≤ 1.8.7 | ≥ 0.5.0 (No fix recorded)
Github.com/argoproj/argo-cd1 product
- v2< 2.1.14 | ≥ 2.2.0, < 2.2.8 | ≥ 2.3.0, < 2.3.2
3 vendors · 3 products
References
15 links- github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pwwX Refsource MISCWEBAdvisoryMitigationThird Party AdvisoryExploit
- github.com/argoproj/argo-cd/commit/af03b291d4b7e9d3ce9a6580ae9c8141af0e05cfWEBFIXPatchThird Party Advisory
- github.com/argoproj/argo-cdPACKAGE