CVE-2024-31990CWE-863

Argo CD' API server does not enforce project sourceNamespaces

Medium · published April 15, 2024

CVSS v3.1
4.8
EPSS
0%
Percentile
38.0
In the wild
Unconfirmed
What it is

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00448 · 38.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2024-04-15T19:52Z
EPSS history
Timeline
  • 15 APR 19:52Z
    Argo CD' API server does not enforce project sourceNamespaces
    cvelistv5