CVE-2022-24730

🗓️ 23 Mar 2022 20:50:09Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 181 Views🌐 WEB

Argo CD version 1.3.0 and before 2.1.11, 2.2.6, 2.3.0 path traversal and access control vulnerability

Reporter	Title	Published	Views	Family All 20
BDU FSTEC	The vulnerability of the declarative delivery tool for GitOps on Kubernetes Argo CD, related to deficiencies in pathname restrictions for directories, allows attackers to gain unauthorized access to protected information.	16 Sep 202300:00	–	bdu_fstec
Circl	CVE-2022-24730	23 Mar 202223:34	–	circl
CNNVD	GitHub argo-cd 访问控制错误漏洞	22 Mar 202200:00	–	cnnvd
Cvelist	CVE-2022-24730 Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server	23 Mar 202220:50	–	cvelist
EUVD	EUVD-2022-1529	3 Oct 202520:07	–	euvd
Github Security Blog	Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server	24 Mar 202200:04	–	github
GitLab Advisory Database	Improper Access Control	24 Mar 202200:00	–	gitlab
NVD	CVE-2022-24730	23 Mar 202221:15	–	nvd
OSV	CVE-2022-24730 Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server	23 Mar 202220:50	–	osv
OSV	GHSA-R9CR-HVJJ-496V Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server	24 Mar 202200:04	–	osv

NVD

Vulners

Node

argoproj argo_cdRange1.3.0–2.1.11

argoproj argo_cdRange2.2.0–2.2.6

argoproj argo_cdMatch2.3.0rc1

argoproj argo_cdMatch2.3.0rc2

argoproj argo_cdMatch2.3.0rc4

argoproj argo_cdMatch2.3.0rc5

[
  {
    "product": "argo-cd",
    "vendor": "argoproj",
    "versions": [
      {
        "status": "affected",
        "version": ">= 1.3.0, < 2.1.11"
      },
      {
        "status": "affected",
        "version": ">= 2.2.0, < 2.2.6"
      },
      {
        "status": "affected",
        "version": ">= 2.3.0-rc1, < 2.3.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/argoproj/argo-cd/security/advisories/GHSA-r9cr-hvjj-496v

Parameter	Position	Path	Description	CWE
repo_url	path	/api/v1/repositories/{repo_url}/appdetails	Path traversal with improper access control allows leaking files through appdetails endpoint when accessed with a repository that user has read access.	CWE-863, CWE-284, CWE-22

17 Jun 2026 04:32Current

6.8Medium risk

Vulners AI Score6.8

CVSS 24

CVSS 3.16.5 - 7.7

EPSS0.0092

SSVC

argo cd kubernetes gitops cve-2022-24730 vulnerability security path traversal access control nvd