CVE-2021-23347

Cross-site Scripting (XSS)

Medium · published March 3, 2021

CVSS v3.1
4.7
EPSS
1%
Percentile
47.7
In the wild
Unconfirmed
What it is

The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00594 · 47.7th percentile
Published
2021-03-03T09:55Z
EPSS history
Timeline
  • 03 MAR 09:55Z
    Cross-site Scripting (XSS)
    cvelistv5