CVE-2024-22424 Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable to a cross-server request forgery CSRF attack when the attacker has the ability to write HTML to a page on the same parent domain as Argo C...

CVE-2024-22424 Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable to a cross-server request forgery CSRF attack when the attacker has the ability to write HTML to a page on the same parent domain as Argo C...

CVE-2024-22424

CVE-2024-22424 affects Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 (and related 2.7.16 per some advisories). The root cause is failure to validate that requests carry the correct content type, allowing bypass of browser CORS preflight checks and enabling CSRF via cross-origin...

CVE-2024-22424 Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable to a cross-server request forgery CSRF attack when the attacker has the ability to write HTML to a page on the same parent domain as Argo C...

PT-2024-1295 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 Description: The issue is related to a cross-server request forgery CSRF attack. An attacker can trick an authenticated Argo CD user into loading a web page that contains code to ca...

GHSA-9763-4F94-GFCH vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, actions-runner-controller, crossplane-provider-family-aws, crossplane, flux, kaniko, crossplane-provider-aws-s3, slsa-verifier, zarf, crossplane-provider-aws-dynamodb, crossplane-provider-aws-iam, flux-image-automation-controller,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: argo-events, pulumi-kubernetes-operator, argo-events-fips, flux-notification-controller, task, snyk-cli, melange, argo-workflows...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: task, argo-events, melange, pulumi-kubernetes-operator, flux-notification-controller, snyk-cli, argo-workflows...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: argo-events, pulumi-kubernetes-operator, argo-events-fips, flux-notification-controller, task, snyk-cli, melange, argo-workflows...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: task, argo-events, melange, pulumi-kubernetes-operator, flux-notification-controller, snyk-cli, argo-workflows...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, prometheus-adapter, spark-operator, nodetaint, aws-efs-csi-driver, aws-ebs-csi-driver, aws-efs-csi-driver-fips, ip-masq-agent...

CVE-2023-5528 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, prometheus-adapter, spark-operator, nodetaint, aws-efs-csi-driver, aws-ebs-csi-driver, aws-efs-csi-driver-fips, ip-masq-agent...

CVE-2023-47108 vulnerabilities

Vulnerabilities for packages: envoy-ratelimit, kubernetes-csi-external-resizer, k3s, kubescape, temporal-server, buildkitd, kine, kubernetes, volume-modifier-for-k8s, kubevela, metrics-server, docker-compose, temporal, cri-tools...

GHSA-Q78C-GWQW-JCMC vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, aws-efs-csi-driver...

CVE-2023-3955 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, kubeflow-pipelines, aws-efs-csi-driver-fips...

CVE-2023-3955 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, aws-efs-csi-driver...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubeflow-fips, plutono-fips, kiam, slsa-verifier, spark-operator, terraform-provider-sendgrid, vault-csi-provider, kubernetes-csi-livenessprobe-fips, scorecard, metrics-server-fips, smarter-device-manager-fips, prometheus-adapter-fips, dgraph, aactl, kube-oidc-proxy,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: scorecard, spark-operator, cortex, kubescape, terraform-provider-sendgrid, up, buildkitd, aactl, slsa-verifier, src, k3d, kubevela, dgraph, kubeflow...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: oauth2-proxy, terraform-provider-azurerm, terraform-provider-sendgrid, secrets-store-csi-driver, envoy-ratelimit, ip-masq-agent, kubeflow-katib, flux-helm-controller, wireguard-go, pulumi, hugo, dynamic-localpv-provisioner, bom, nri-prometheus, grype,...

Path Traversal

github.com/argoproj/argo-cd/v2 is vulnerable to Path Traversal. The vulnerability is caused by a missing validation check in the repo server API that prevents file traversal attacks. This can lead to an attacker leaking values or files from the referenced Helm Chart by using a using a...