CVE-2025-47933

Argo CD allows cross-site scripting on repositories page

Résumé

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Go github.com/argoproj/argo-cd

[{"type":"SEMVER","events":[{"introduced":"1.2.0-rc1"},{"last_affected":"1.8.7"}]}]

Go github.com/argoproj/argo-cd/v2

[{"type":"SEMVER","events":[{"introduced":"2.14.0-rc1"},{"fixed":"2.14.13"}]}]

Go github.com/argoproj/argo-cd/v3

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.4"}]}]

Bitnami argo-cd

[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"fixed":"2.13.8"},{"introduced":"2.14.0"},{"fixed":"2.14.13"},{"introduced":"3.0.0"},{"fixed":"3.0.4"}]}]

Références

advisory github.com
advisory nvd.nist.gov
advisory github.com
package github.com
patch github.com

Métadonnées

CVE: CVE-2025-47933
GHSA: GHSA-2hj5-g64g-fp6p
Publication: 2025-05-29
Première détection SecPulse: il y a 1 an
Source initiale: OSV.dev (Open Source Vulnerabilities)

CWE

CWE-79

Sources de détection

OSV.dev (Open Source Vulnerabilities) il y a 2 mois