CVE-2022-24905

lowpriority · track · 17EPSS 0.013 · 70 %ileEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.30% (70th) EPSS
CVSS 2.6 · low
Is it mine?
39 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-27

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was found in Argo CD prior to versions 2.3.4, 2.2.9, and 2.1.15 that allows an attacker to spoof error messages on the login screen when single sign on (SSO) is enabled. In order to exploit this vulnerability, an attacker would have to trick the victim to visit a specially crafted URL which contains the message to be displayed. As far as the research of the Argo CD team concluded, it is not possible to specify any active content (e.g. Javascript) or other HTML fragments (e.g. clickable links) in the spoofed message. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. There are currently no known workarounds.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedopenshift-gitops-1/applicationset-rhel8@sha256:6def698fb89067d2259a34bced9080d3c7b509b711fda795d73f427f9068c1ba_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4671
  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:2c780222e3aeaffb466f04f5948d474921e9f2a3cc217c4dcc7f83ae268b55a1_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4671
  • Fixedopenshift-gitops-1/dex-rhel8@sha256:54bb64a4d6e3044d99f534cce1fbbb2053f8880139a98fddb9e405a71c067359_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4671
  • Fixedopenshift-gitops-1/gitops-operator-bundle@sha256:6cf4377fd2efa8ae4965dae8e6cc7cd7017fd739e43618d6daea61244fe40d47_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4671
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:95e2be5c2578571d6461ec691466c95f5928fc25e97f7161b98b2a9496a22b5b_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4671
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:97871502a00aee8f673601da76111cc39a13088517d6e1d07882f0c4cc249ffc_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4671
  • Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:c1aa038cbdef8e2eadb2fee362249aa85e5678a4367f9bdd4320de63e27ef705_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4671
  • Fixedopenshift-gitops-1/applicationset-rhel8@sha256:a82e54981e175c7ea5e615aef6659be0c8c2bb2042c4ca762f3551244c352a0d_amd64 as a component of Red Hat OpenShift GitOps 1.5redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4690
  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:87e4957bcecd23fc21fe44d00a6c40b7bdb62afd0c606ca5dfbd8defeeaad83a_amd64 as a component of Red Hat OpenShift GitOps 1.5redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4690
  • Fixedopenshift-gitops-1/dex-rhel8@sha256:6e1df31388b61351e0ecefe05085dcba23f1524f5c8bb59afd8a00d9039310d6_amd64 as a component of Red Hat OpenShift GitOps 1.5redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4690
  • Fixedopenshift-gitops-1/gitops-operator-bundle@sha256:2420c7de9ade63c11b453730568a64772ca3ec1551b9b5e9ae8bfa2eef2b3cd9_amd64 as a component of Red Hat OpenShift GitOps 1.5redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4690
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:e05a6d29b0822647709a521e47584222e5451c0e53940eacf05b7ac9732bae93_amd64 as a component of Red Hat OpenShift GitOps 1.5redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4690
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:969a1b2b159bdd09f44edb3edcaf7ce9928b223f823a4999404ae8f068b006aa_amd64 as a component of Red Hat OpenShift GitOps 1.5redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4690
  • Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:df2f63afa7c824ef139fdc44c420f6c1cc1f0986df520ee3b3e4afd02882566e_amd64 as a component of Red Hat OpenShift GitOps 1.5redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4690
  • Fixedopenshift-gitops-1/applicationset-rhel8@sha256:8621918dacdc5d45ed47f8ecc87e178f5e98b550049d2bee2fd7bba0a918327d_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4691
  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:d38a00c5f807c275dd6830de16899cd51dc7d57b8dd63c0ec5183fa4d28d2a69_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4691
  • Fixedopenshift-gitops-1/dex-rhel8@sha256:b58f08d8e8c03c9ed044795574e2645848eec6ec987233edcc74f99131cfc83d_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4691
  • Fixedopenshift-gitops-1/gitops-operator-bundle@sha256:cf03b9810510a741c56c55f085832de2f8dd324cb21fb27f5085dbbc2e350f4c_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4691
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:ea3f6698c273e1bd2c45d931c44a45f01c15ef1ebd24bc969b824019ff690aac_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4691
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:aff088cfffc96a75edacd496fccb2bb374130faf1d9d60acf967469eb60a54db_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4691
  • Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:ef21fbf7fef28e0552515305394ba1496626353476bdc1ad59282bd54f500e32_amd64 as a component of Red Hat OpenShift GitOps 1.3redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4691
  • Fixedopenshift-gitops-1/applicationset-rhel8@sha256:e890bd2bbd025a368c7dd0625612ced98d0e11b110b6381fdb0888dac2504728_amd64 as a component of Red Hat OpenShift GitOps 1.4redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4692
  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:3f55b9686dfa194667db93cd044a71b2e2d52f73ac10f0f99d95197bb4e5f130_amd64 as a component of Red Hat OpenShift GitOps 1.4redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4692
  • Fixedopenshift-gitops-1/dex-rhel8@sha256:eb39bc1c6907584501efd99ef9a25faaf6737b7ef4377e5c35dc833d4ec93531_amd64 as a component of Red Hat OpenShift GitOps 1.4redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4692
  • Fixedopenshift-gitops-1/gitops-operator-bundle@sha256:09bb7f98f120c9ceb5cdfc8b6b86f1b290be9c841bf6aa67c91bb3b05367b5b2_amd64 as a component of Red Hat OpenShift GitOps 1.4redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4692
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:e9b8ac8b2187fcd5c1533f7a8c7c12715bd2cfac7ceac5b750bc510f5bf57fd2_amd64 as a component of Red Hat OpenShift GitOps 1.4redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4692
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:f99ceb45207658527db7e1cf2938a393d876b2431cdc583ea05a2f9cb305e071_amd64 as a component of Red Hat OpenShift GitOps 1.4redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4692
  • Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:e371787eefe08695d130b0fd84c81c4bf966be6f1c82222e5c9ae0a8fa45428f_amd64 as a component of Red Hat OpenShift GitOps 1.4redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:4692
02

cvss

Technical severity, 0–10. One row per scoring source.

4.3
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.6–4.3

v2.02.6lowAV:N/AC:H/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 4.9 · impact 2.9
v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 1.4
v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · ENISA EU
v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · security-advisories@github.comexploitability 2.8 · impact 1.4
v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · OSV
v3.14mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · Red Hat Product Security US
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20USCWE-79US
05

affected products (39)

Products and version ranges known to be affected.

showing 20 of 39
06

advisories (6)

Vendor and ecosystem advisories describing this.

  • RHSA-2022:4671Red Hat Security Advisory: Red Hat OpenShift GitOps security update2022-05-18csaf · redhat_csafUS

    An update is now available for Red Hat OpenShift GitOps 1.3 in openshift-gitops-argocd container. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2022:4690Red Hat Security Advisory: Red Hat OpenShift GitOps security update2022-05-18csaf · redhat_csafUS

    An update is now available for Red Hat OpenShift GitOps 1.5 in openshift-gitops-argocd container. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2022:4691Red Hat Security Advisory: Red Hat OpenShift GitOps security update2022-05-18csaf · redhat_csafUS

    An update is now available for Red Hat OpenShift GitOps 1.3 in openshift-gitops-argocd container. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2022:4692Red Hat Security Advisory: Red Hat OpenShift GitOps security update2022-05-18csaf · redhat_csafUS

    An update is now available for Red Hat OpenShift GitOps 1.4 in openshift-gitops-argocd container. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • GHSA-xmg8-99r8-jc2jLogin screen allows message spoofing if SSO is enabled2022-05-24ghsa · osvUS

    ### Impact A vulnerability was found in Argo CD that allows an attacker to spoof error messages on the login screen when SSO is enabled. In order to exploit this vulnerability, an attacker would have to trick the victim to visit a specially crafted URL which contains the message to be displayed. As far as the research of the Argo CD team concluded, it is not possible to specify any active content (e.g. Javascript) or other HTML fragments (e.g. clickable links) in the spoofed message. ### Patched versions A patch for this vulnerability has been released in the following Argo CD versions: * v2.3.4 * v2.2.9 * v2.1.15 ### Workarounds No workaround available. #### Mitigations It is advised to update to an Argo CD version containing a fix for this issue (see *Patched versions* above). ### Credits This vulnerability was discovered by Naufal Septiadi (<naufal@horangi.com>) and reported to us in a responsible way. ### For more information <!-- Use only one of the paragraphs below. Remove all others. --> <!-- For Argo CD --> * Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions) * Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd

  • GO-2022-0454Login screen allows message spoofing if SSO is enabled in github.com/argoproj/argo-cd2024-08-21vendor · osvUS

    Login screen allows message spoofing if SSO is enabled in github.com/argoproj/argo-cd

07

also known as (5)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdosvnvdredhat_csafNVDCVE.orgMITRE
published 2022-05-20modified 2026-06-17
09

references (18)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan