CVE-2023-22736 argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled

🗓️ 26 Jan 2023 03:35:27Reported by GitHub_MType

CVE-2023-22736 Argo CD Controller authorization bypass bu

Reporter	Title	Published	Views	Family All 18
BDU FSTEC	The vulnerability of the declarative delivery tool for GitOps in Kubernetes Argo CD allows attackers to increase their privileges.	9 Feb 202300:00	–	bdu_fstec
CNNVD	ArgoCD 安全漏洞	25 Jan 202300:00	–	cnnvd
CVE	CVE-2023-22736	26 Jan 202303:35	–	cve
EUVD	EUVD-2023-0369	3 Oct 202520:07	–	euvd
Github Security Blog	Controller reconciles apps outside configured namespaces when sharding is enabled	25 Jan 202319:39	–	github
Hacker One	Internet Bug Bounty: Argo CD reconciles apps outside configured namespaces when sharding is enabled	25 Jan 202319:04	–	hackerone
NVD	CVE-2023-22736	26 Jan 202321:18	–	nvd
OSV	CVE-2023-22736 argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled	26 Jan 202303:35	–	osv
OSV	GHSA-6P4M-HW2H-6GMW Controller reconciles apps outside configured namespaces when sharding is enabled	25 Jan 202319:39	–	osv
OSV	GO-2023-1512 Controller reconciles apps outside configured namespaces when sharding is enabled in github.com/argoproj/argo-cd	20 Aug 202420:26	–	osv

[
  {
    "vendor": "argoproj",
    "product": "argo-cd",
    "versions": [
      {
        "version": ">= 2.5.0=rc1, < 2.5.8",
        "status": "affected"
      },
      {
        "version": "= 2.6.0-rc4, < 2.6.0-rc5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/argoproj/argo-cd/security/advisories/GHSA-6p4m-hw2h-6gmw

26 Jan 2023 03:35Current

8.4High risk

Vulners AI Score8.4

CVSS 3.18.5

EPSS0.0078

CWE-862