CVE-2024-28175

mediumpriority · track · 22EPSS 0.007 · 51 %ileDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.65% (51st) EPSS
CVSS 5.4 · medium
Is it mine?
125 products
Check your exposure
Who says so?
7 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the `link.argocd.argoproj.io` annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. A patch for this vulnerability has been released in Argo CD versions v2.10.3 v2.9.8, and v2.8.12. There are no completely-safe workarounds besides upgrading. The safest alternative, if upgrading is not possible, would be to create a Kubernetes admission controller to reject any resources with an annotation starting with link.argocd.argoproj.io or reject the resource if the value use an improper URL protocol. This validation will need to be applied in all clusters managed by ArgoCD.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:06b3f1d7954bb4bf996a4e322a88dcf34be9e0dc5c9460921042d24702cf9273_arm64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1345
  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:5bd431935a0f74050413b7f08261e11865e7d8d003f3c5031bfbef67169fec6d_ppc64le as a component of Red Hat OpenShift GitOps 1.10redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1345
  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:7cb494d99634885e90b74a6c0a34ed3334080d9c07eea6aed5391c70f91fcf98_amd64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1345
  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:a66d01c15bcfeee90db04b8bdaabdfa995f80fd90d6e6d6397562c9afeffc39a_s390x as a component of Red Hat OpenShift GitOps 1.10redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1345
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:23fa0c400b43aeee323ea4bd0b33bfc183bfa1c9d47fe9221cc576e228855afb_ppc64le as a component of Red Hat OpenShift GitOps 1.10redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1345
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:5b3a993c39b2256cdd11ca1dca87713271f49fe07d630f872582388e5132c454_arm64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1345
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:84e0f709503a4e361f58a1e195e13d9cd18bd9fd12468c18a262af2f259314e4_amd64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1345
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:9f706db14cd4782e5e84cee8c6772db7f6b52fb53e1c825f35875c202dfff537_s390x as a component of Red Hat OpenShift GitOps 1.10redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1345
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:1f18050d0e9c10388d6361f9514f8db9b5fdaaf1edafd2a5809e9e816ed64c4b_amd64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1345
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:ab302c79427c6750450a3ec41c783bf343ddd396ddd947af6757466ee2b7ec62_ppc64le as a component of Red Hat OpenShift GitOps 1.10redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1345
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:adc811bd291f1c55a72c197e39533d70574e1d20118a969ecb76afe5a03b7205_s390x as a component of Red Hat OpenShift GitOps 1.10redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1345
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:d416b2f0ea3b69436e418d9ea4478cf40482c08a89f970c11b85d418453ec0f5_arm64 as a component of Red Hat OpenShift GitOps 1.10redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1345
  • Fixedopenshift-gitops-1/argo-rollouts-rhel8@sha256:7ade7c64aedd610fa822b8366522ac480e973bc84c73a2a03a68a78fbcd4f614_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/argo-rollouts-rhel8@sha256:93769a67b9b6b8795a11f3e1c77ea8a41084f0aea164244d48cdecc7aef7ec46_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/argo-rollouts-rhel8@sha256:963b67a8e1ec1b9f08a869a4233dc017ec57b50e083fe3434bf143789c58c5a6_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/argo-rollouts-rhel8@sha256:b3c2ce5bb5f18510cbec121264f167abd4ce3f2245640bfbc1dff42b093f2e4d_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:1a8e335f35cf56d858c92b03bf9f13e2ef3bd326a5155e022517130ee4fb2e44_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:5661b095173b6ac4e5933708a99ad74d671200e2790eccdc403cbc33ac0309ef_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:e4cb3df8c0b83ba2c8f56fa06754c2afb40c75382488d3b1e337ce4f1e45b0c6_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:e82216628e8fe91dffaa78b0653b148e55035b459ca4c283a33f4439ce1edb3f_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/console-plugin-rhel8@sha256:1681e954c99a358ae92d01a0e822068e5b1e0d390cd510a4a703140767a48e0d_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/console-plugin-rhel8@sha256:2a18498dd55a7220a3cb95206cc200cec9c755c38736ad58f6e7e7b940869d4a_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/console-plugin-rhel8@sha256:8a400a97552170760891915c4855c9ae302c62588ad59a35c8aa2443f5482b0d_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/console-plugin-rhel8@sha256:fc0966ae2216547e28efc61461f37ec1320b06ff0c29f4f93150b0e2cd091e1d_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/dex-rhel8@sha256:57d8fa22347e327bb163fb0d7e3710f83f1b2dd248acd0be5f3d8562b55197bb_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/dex-rhel8@sha256:5eccc3f29285dcbf796181cf9d29725d1be68d6f7ecc7e1152fe943708066505_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/dex-rhel8@sha256:797dbf9aa33b3b00cca9a0f31bebff7ab35dc1e5d1bfd99ebb0aa74b7550cad1_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/dex-rhel8@sha256:f51071e02ac671512e0bc87a69a4247208ece219a671a6975a8b603689f16821_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/gitops-operator-bundle@sha256:32efac25ae3acebe9de6252c9ed46c3e8f3011bed3353b8ec6a88457a026d80a_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:2ed30e3026e13ca181a8c31dc760986b6b6183f3ac602ea7eeb88b180e80daa2_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:353368e67b2749bb0ec018cb0a5b3ae9d10881e7bc3a207dda43790b27e1dd5b_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:3e3bd3ff2f09371d3fdbad3468daadadb8f426a3210dcfbd4d5e17e071f68e06_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:f33126d9622317c68bff1b482ec97cdb8ab135168528740d3d7e1aa70c4daed2_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:3b42204307b0f129ecca6160f1ef0fd076ae84493ab3bc22b11a80dbd7eab0c1_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:977be039dfe7e0b53fc984030eabe31d027cda5457955a9c78bfcf670fed3d75_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:b7d7a1090c008b96f4837062e5d44f1666a6181a96933d9de7d010a470e764af_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:ba4bd092cd6712005677949f9369b53f089d68a7c1e8a28a4d0584d120eca039_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:517b591c2f38fd4d7b14d3dd957569b5b862d950552c96b7d7c3d4f30c0c3e1c_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:8bd3a68563363904ea589b23b71fb49bbf6264a632cfab20e792fdc119ff8981_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:dc2d8ee2b6a5cb23a84b457fa8b2ec8512cb71ef8aec0f651924dab8b6702f2a_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/kam-delivery-rhel8@sha256:f51fd302417f7171ba723e0ea5df0305253a652e247b8737b60b465e3573a6e2_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/must-gather-rhel8@sha256:308dde69749187080fecd3d82aa4a08ed3ac1c9f4e98ef502b6f7afd9023e1ba_amd64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/must-gather-rhel8@sha256:697ec831988f516a1387675acf0325a495af4cc4140ca5bf4698c51367e78ebd_s390x as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/must-gather-rhel8@sha256:96969f9e59b59364e239498d71b53d6faae74dabe9ea2ef5180d28833fbb6956_ppc64le as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/must-gather-rhel8@sha256:cad722d913cd44aceb3caa78b87477e3283e4ce9f1e90e5f74f4ddd74d89aeaf_arm64 as a component of Red Hat OpenShift GitOps 1.11redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1346
  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:696c295db4d9361bd51a3717dc9be30dcff8fe987a69681887f507fce363f0c0_arm64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1441
  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:6ba83aab265e6939d438046144084636b3864e015991e3b94f152369154b48f4_amd64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1441
  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:81368be3ab45e859dfa16d4c4edda6b26bca73cb139dfd5c881fbdb47f63561d_s390x as a component of Red Hat OpenShift GitOps 1.12redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1441
  • Fixedopenshift-gitops-1/argocd-rhel8@sha256:8cb78b85acbdc3a2cae1f69111459cbef89b267dcd7a6eb258294fe511b0bb1c_ppc64le as a component of Red Hat OpenShift GitOps 1.12redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1441
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:13eb0110861b96f5379eff1ca55a3901d29441a0b5fcd8147b32541a045fd1ab_s390x as a component of Red Hat OpenShift GitOps 1.12redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1441
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:adeb0ff5dafd71aff367577ef12333e38d6a78f749cc264b469119cfaea8746b_ppc64le as a component of Red Hat OpenShift GitOps 1.12redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1441
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:b47116db28d6584ea80f61e4de15b720be0f27cb6e24089da7234973dd16ba39_amd64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1441
  • Fixedopenshift-gitops-1/gitops-rhel8-operator@sha256:e2ea24a3e0795955166f479ef8545268056997a62f556b56c2a3211732c6791a_arm64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1441
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:14ea7dd3f4ac63a554da457318968b62e8cce78442215591ec9501797a365424_amd64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1441
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:6c1ffb8fc7f7390761211b251804e581028683190f93fb40d0b7c35ec3750836_arm64 as a component of Red Hat OpenShift GitOps 1.12redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1441
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:904000843e5ed6f5cc312b78c8205c34174e04739f0795d2a41c275b0ba5afa5_s390x as a component of Red Hat OpenShift GitOps 1.12redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1441
  • Fixedopenshift-gitops-1/gitops-rhel8@sha256:a8cac5416ebc0528347507b4083cdbdb76c8ecb5f2c1a0d7580847ae33903036_ppc64le as a component of Red Hat OpenShift GitOps 1.12redhat_csaf

    Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2024:1441
02

cvss

Technical severity, 0–10. One row per scoring source.

9.1
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5–9.1

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.3 · impact 2.7
v3.19criticalAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:Hsecondary · ENISA EU
v3.19criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:Hsecondary · security-advisories@github.comexploitability 2.3 · impact 6
v3.19criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:Hsecondary · OSV
v3.15mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.18.9highCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:Hsecondary · Red Hat Product Security US
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USprimaryCWE-79USCWE-79USCWE-79US
05

affected products (125)

Products and version ranges known to be affected.

showing 20 of 125
06

advisories (7)

Vendor and ecosystem advisories describing this.

  • RHSA-2024:1345Red Hat Security Advisory: Red Hat OpenShift GitOps security update2024-03-15csaf · redhat_csafUS

    An update is now available for Red Hat OpenShift GitOps 1.10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2024:1346Red Hat Security Advisory: Red Hat OpenShift GitOps security update2024-03-16csaf · redhat_csafUS

    An update is now available for Red Hat OpenShift GitOps 1.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2024:1441Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.12.0 security update2024-03-20csaf · redhat_csafUS

    An update is now available for Red Hat OpenShift GitOps v1.12.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • WID-SEC-W-2024-0647Red Hat OpenShift: Schwachstelle ermöglicht Cross-Site ScriptingDeutsch2024-03-17csaf · cert_bundDE

    Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

  • GHSA-jwv5-8mqv-g387Cross-site scripting on application summary component2024-03-15ghsa · osvUS

    ### Summary Due to the improper URL protocols filtering of links specified in the `link.argocd.argoproj.io` annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. ### Impact All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. ### Patches A patch for this vulnerability has been released in the following Argo CD versions: * v2.10.3 * v2.9.8 * v2.8.12 ### Workarounds There are no completely-safe workarounds besides **upgrading**. The safest alternative, if upgrading is not possible, would be to create a [Kubernetes admission controller](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/) to reject any resources with an annotation starting with `link.argocd.argoproj.io` or reject the resource if the value use an improper URL protocol. This validation will need to be applied in all clusters managed by ArgoCD. #### Mitigations 1. Avoid clicking external links presented in the UI. The link's title is user-configurable. So even if you hover the link, and the tooltip looks safe, the link might be malicious. The only way to be certain that the link is safe is to inspect the page's source. 2. Carefully limit who has permissions to edit Kubernetes resource manifests (this is configured in [RBAC](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/) for ArgoCD). The external-links are set as annotations on Kubernetes resources. Any persona with write access to resources managed by ArgoCD could be an actor. ### References [Documentation for the external links feature](https://argo-cd.readthedocs.io/en/stable/user-guide/external-url/) ### Credits Disclosed by [RyotaK](https://ryotak.net) (@Ry0taK) ### For more information - Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc) or [discussions](https://github.com/argoproj/argo-cd/discussions) - Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd

  • BIT-argo-cd-2024-28175Cross-site scripting on application summary component in argo-cd2024-03-15vendor · osvUS

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the `link.argocd.argoproj.io` annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. A patch for this vulnerability has been released in Argo CD versions v2.10.3 v2.9.8, and v2.8.12. There are no completely-safe workarounds besides upgrading. The safest alternative, if upgrading is not possible, would be to create a Kubernetes admission controller to reject any resources with an annotation starting with link.argocd.argoproj.io or reject the resource if the value use an improper URL protocol. This validation will need to be applied in all clusters managed by ArgoCD.

  • GO-2024-2646Cross-site scripting on application summary component in github.com/argoproj/argo-cd/v22024-03-22vendor · osvUS

    Due to the improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. A malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources.

07

also known as (7)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bduosvcert_bundnvdredhat_csafNVDCVE.orgMITRE
published 2024-03-13modified 2026-06-17
10

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan