CVE-2024-31990 Argo CD' API server does not enforce project sourceNamespaces

2024-04-1519:52:55

CWE-863

GitHub_M

github.com

argo cd

api server

vulnerability

kubernetes

gitops

cve-2024-31990

fix

2.10.7

2.9.12

2.8.16

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

AI Score

6.5

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:kubernetes:argo-cd:*:*:*:*:*:*:*:*"
    ],
    "vendor": "kubernetes",
    "product": "argo-cd",
    "versions": [
      {
        "status": "affected",
        "version": "*"
      }
    ],
    "defaultStatus": "unknown"
  }
]