The vulnerability of the declarative delivery tool for GitOps on Kubernetes Argo CD, related to deficiencies in the authentication process, allows attackers to increase their privileges.

Argo CD authentication flaw allows privilege escalation in Kubernetes GitOps deployments.

Reporter	Title	Published	Views	Family All 17
Circl	CVE-2023-23947	16 Feb 202320:12	–	circl
CNNVD	ArgoCD 安全漏洞	16 Feb 202300:00	–	cnnvd
CVE	CVE-2023-23947	16 Feb 202317:39	–	cve
Cvelist	CVE-2023-23947 Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets	16 Feb 202317:39	–	cvelist
EUVD	EUVD-2023-0613	3 Oct 202520:07	–	euvd
Github Security Blog	Users with any cluster secret update access may update out-of-bounds cluster secrets	16 Feb 202320:47	–	github
NVD	CVE-2023-23947	16 Feb 202318:15	–	nvd
OSV	CVE-2023-23947 Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets	16 Feb 202317:39	–	osv
OSV	GHSA-3JFQ-742W-XG8J Users with any cluster secret update access may update out-of-bounds cluster secrets	16 Feb 202320:47	–	osv
OSV	GO-2023-1577 Users with any cluster secret update access may update out-of-bounds cluster secrets in github.com/argoproj/argo-cd	20 Aug 202420:26	–	osv

Vulners

Node

linux argo_cdRange2.3.0–2.3.17

linux argo_cdRange2.4.0–2.4.23

linux argo_cdRange2.5.0–2.5.11

linux argo_cdRange2.6.0–2.6.2

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-23947
github	www.github.com/argoproj/argo-cd/commit/fbb0b99b1ac3361b253052bd30259fa43a520945
github	www.github.com/argoproj/argo-cd/security/advisories/GHSA-3jfq-742w-xg8j
access	www.access.redhat.com/security/cve/cve-2023-23947
web	www.web.nvd.nist.gov/view/vuln/detail

01 Mar 2023 00:00Current

7.7High risk

Vulners AI Score7.7

CVSS 28.3

CVSS 39.1

EPSS0.00671