{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T07:53:05.250","vulnerabilities":[{"cve":{"id":"CVE-2022-24730","sourceIdentifier":"security-advisories@github.com","published":"2022-03-23T21:15:08.023","lastModified":"2026-06-17T04:32:23.350","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been granted `get` access for a repository containing a Helm chart can craft an API request to the `/api/v1/repositories/{repo_url}/appdetails` endpoint to leak the contents of out-of-bounds files from the repo-server. The malicious payload would reference an out-of-bounds file, and the contents of that file would be returned as part of the response. Contents from a non-YAML file may be returned as part of an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from other Applications' source repositories or any secrets which have been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The patches prevent path traversal and limit access to users who either A) have been granted Application `create` privileges or B) have been granted Application `get` privileges and are requesting details for a `repo_url` that has already been used for the given Application. There are currently no known workarounds."},{"lang":"es","value":"Argo CD es una herramienta declarativa de entrega continua GitOps para Kubernetes. Argo CD a partir de la versión 1.3.0 pero antes de las versiones 2.1.11, 2.2.6 y 2.3.0 es vulnerable a un fallo de salto de ruta, agravado por un fallo de control de acceso inapropiado, que permite a un usuario malicioso con acceso al repositorio de sólo lectura filtrar archivos confidenciales del repo-servidor de Argo CD. Un usuario malicioso de Argo CD al que le haya sido concedido acceso \"get\" para un repositorio que contenga un gráfico de Helm puede diseñar una petición de API al endpoint \"/api/v1/repositories/{repo_url}/appdetails\" para filtrar el contenido de archivos fuera de límites del servidor de repositorios. La carga útil maliciosa haría referencia a un archivo fuera de límites, y el contenido de ese archivo sería devuelto como parte de la respuesta. El contenido de un archivo no YAML puede ser devuelto como parte de un mensaje de error. El atacante tendría que conocer o adivinar la ubicación del archivo de destino. Los archivos confidenciales que podrían filtrarse incluyen archivos de los repositorios de fuentes de otras aplicaciones o cualquier secreto que haya sido montado como archivo en el servidor de repositorios. Esta vulnerabilidad está parcheada en las versiones 2.1.11, 2.2.6 y 2.3.0 de Argo CD. Los parches evitan el salto de ruta y limitan el acceso a usuarios que, o bien A) han recibido privilegios \"create\" de aplicaciones, o bien B) han recibido privilegios \"get\" de aplicaciones y están solicitando detalles para una \"repo_url\" que ya ha sido usada para la aplicación en cuestión. Actualmente no se presentan medidas de mitigación conocidas"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"argoproj","product":"argo-cd","versions":[{"version":">= 1.3.0, < 2.1.11","status":"affected"},{"version":">= 2.2.0, < 2.2.6","status":"affected"},{"version":">= 2.3.0-rc1, < 2.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-23T14:08:40.775712Z","id":"CVE-2022-24730","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-284"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*","versionStartIncluding":"1.3.0","versionEndExcluding":"2.1.11","matchCriteriaId":"E1786BA5-590E-495A-BF42-6A73F927B50B"},{"vulnerable":true,"criteria":"cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*","versionStartIncluding":"2.2.0","versionEndExcluding":"2.2.6","matchCriteriaId":"3BF852EA-7214-413B-9E72-DFB0165067B6"},{"vulnerable":true,"criteria":"cpe:2.3:a:argoproj:argo_cd:2.3.0:rc1:*:*:*:*:*:*","matchCriteriaId":"6FA0E90D-79C0-4F34-8FB5-061073BCEEA7"},{"vulnerable":true,"criteria":"cpe:2.3:a:argoproj:argo_cd:2.3.0:rc2:*:*:*:*:*:*","matchCriteriaId":"794935A2-5EF6-4514-9B2B-D06AF10B2EA3"},{"vulnerable":true,"criteria":"cpe:2.3:a:argoproj:argo_cd:2.3.0:rc4:*:*:*:*:*:*","matchCriteriaId":"401CAF1A-8BCC-446F-8C4D-53753BAC8BDA"},{"vulnerable":true,"criteria":"cpe:2.3:a:argoproj:argo_cd:2.3.0:rc5:*:*:*:*:*:*","matchCriteriaId":"FBD86381-9064-4D50-B740-81E6680C6131"}]}]}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-r9cr-hvjj-496v","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-r9cr-hvjj-496v","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}