CVE-2023-22482

🗓️ 26 Jan 2023 21:12:18Reported by [email protected]Type

Argo CD improper authorization bug accepts invalid tokens, patched in v2.6.0-rc

Reporter	Title	Published	Views	Family All 17
Hacker One	Internet Bug Bounty: JWT audience claim is not verified	28 Feb 202318:06	–	hackerone
Veracode	Improper Authorization	3 Feb 202307:29	–	veracode
OSV	CVE-2023-22482	26 Jan 202321:18	–	osv
OSV	JWT audience claim is not verified	25 Jan 202322:02	–	osv
OSV	GO-2023-1520 JWT audience claim is not verified in github.com/argoproj/argo-cd	20 Aug 202420:26	–	osv
Vulnrichment	CVE-2023-22482 JWT audience claim is not verified	25 Jan 202318:25	–	vulnrichment
CVE	CVE-2023-22482	26 Jan 202321:18	–	cve
RedhatCVE	CVE-2023-22482	25 Jan 202319:05	–	redhatcve
Prion	Authorization	26 Jan 202321:18	–	prion
Cvelist	CVE-2023-22482 JWT audience claim is not verified	25 Jan 202318:25	–	cvelist

Nvd

Node

argoproj argo_cdRange1.8.2–2.3.14

argoproj argo_cdRange2.4.0–2.4.20

argoproj argo_cdRange2.5.0–2.5.8

argoproj argo_cdMatch2.6.0rc1

argoproj argo_cdMatch2.6.0rc2

argoproj argo_cdMatch2.6.0rc3

argoproj argo_cdMatch2.6.0rc4

Source	Link
github	www.github.com/argoproj/argo-cd/security/advisories/GHSA-q9hr-j4rf-8fjc

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

26 Jan 2023 21:18Current

9.1High risk

Vulners AI Score9.1

CVSS38.8

EPSS0.00104

CWE-863

argo cd gitops kubernetes cve-2023-22482 improper authorization oidc provider token validation audience claim stolen token vulnerability patch