Home > Vulnerability Database > CVE-2022-41354

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2022-41354

Good to know:

Date: March 26, 2023

An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.

Language: Go

Severity Score

4.3

Related Resources (10)

Url: https://github.com/argoproj/argo-cd/releases/tag/v2.5.16

Url: https://github.com/argoproj/argo-cd/security/advisories/GHSA-2q5c-qw9c-fmvq

Url: https://github.com/argoproj/argo-cd/releases/tag/v2.4.28

Url: https://github.com/chunklhit/cve/blob/master/argo/argo-cd/application_enumeration.md

Url: https://github.com/argoproj/argo-cd/commit/3a28c8a18cc2aa84fe81492625545d25c7a90bc3

Url: https://nvd.nist.gov/vuln/detail/CVE-2022-41354

Url: http://argo.com

Url: https://github.com/argoproj/argo-cd

Url: https://github.com/argoproj/argo-cd/releases/tag/v2.6.7

Url: https://www.mend.io/vulnerability-database/CVE-2022-41354

Severity Score

4.3

Weakness Type (CWE)

Observable Discrepancy

CWE-203

Top Fix

Upgrade Version

Upgrade to version github.com/argoproj/argo-cd/v2 - v2.5.16;github.com/argoproj/argo-cd/v2 - v2.6.7;github.com/argoproj/argo-cd/v2 - v2.4.28

CVSS v3.1

Base Score:	4.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	NONE
Availability (A):	NONE

Do you need more information?

Contact Us