CVE-2025-47933
Argo CD allows cross-site scripting on repositories page
概要
Argo CD allows cross-site scripting on repositories page
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Go
github.com/argoproj/argo-cd
[{"type":"SEMVER","events":[{"introduced":"1.2.0-rc1"},{"last_affected":"1.8.7"}]}]
Go
github.com/argoproj/argo-cd/v2
[{"type":"SEMVER","events":[{"introduced":"2.14.0-rc1"},{"fixed":"2.14.13"}]}]
Go
github.com/argoproj/argo-cd/v3
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.4"}]}]
Bitnami
argo-cd
[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"fixed":"2.13.8"},{"introduced":"2.14.0"},{"fixed":"2.14.13"},{"introduced":"3.0.0"},{"fixed":"3.0.4"}]}]
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com