CVEvulnerability
CVE-2022-24348
7.7 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-02-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.7 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-22
Description
Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.
Affected configurations
• argoproj argo cd (< 2.1.9)
• argoproj argo cd (>= 2.2.0 < 2.2.4)
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments/ Exploit, Third Party Advisory
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7 Exploit, Third Party Advisory
- https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments/ Exploit, Third Party Advisory
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7 Exploit, Third Party Advisory