CVE-2024-31990

CVSS V2 None CVSS V3 None

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.

Overview

CVE ID
CVE-2024-31990

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-04-15T19:52:55.718Z

Last Modified Date
2024-06-04T17:35:59.749Z

Weakness Enumerations

CWE	URL
CWE-863	http://cwe.mitre.org/data/definitions/863.html

References

Reference URL	Reference Tags
https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c	x_refsource_CONFIRM
https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c	x_refsource_MISC
https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5	x_refsource_MISC
https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-31990
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-31990

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 22:41:39				Added to TrackCVE