Linuxfoundation Argo-Cd vulnerabilities

3 CVEs affecting Linuxfoundation Argo-Cd, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-22424, published 2024-01-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-31105, published 2022-07-12. Critical severity, CVSS 9.6. EPSS: 0.8% chance of exploitation in the next 30 days. Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation…
CVE-2022-41354, published 2023-03-27. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.
CVE-2024-22424, published 2024-01-19. High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days. Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The Argo CD API prior to versions 2.10-rc2, 2.9.4, 2.8.8, and 2.7.15 are vulnerable to a cross-server request forgery (CSRF)…