{"id":"CVE-2024-31990","published":"2024-04-15T19:52:55Z","modified":"2024-08-02T01:59:50Z","title":"Argo CD' API server does not enforce project sourceNamespaces","vendor":"argoproj","product":"argo-cd","tier":"tail","description":{"text":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.\n","provenance":"source","from":"CVE.org"},"cvss":{"score":4.8,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00445,"percentile":0.387,"provenance":"source"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-cd/commit/e0ff56d89fbd7d066e9c862b30337f6520f13f17","tags":["x_refsource_MISC"]}],"priority":{"score":11.1,"factors":[{"name":"EPSS percentile","points":7.74},{"name":"CVSS severity","points":3.36}]},"vendorSlug":"argoproj","affectedVersions":[{"vendor":"argoproj","product":"argo-cd","versions":[">= 2.10.0, < 2.10.7",">= 2.9.0, < 2.9.12",">= 2.4.0, < 2.8.16"]}],"affected":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","vulnerableRanges":[">=2.4.0, <2.8.16",">=2.9.0, <2.9.12",">=2.10.0, <2.10.7"],"patched":["2.8.16","2.9.12","2.10.7"],"from":["GHSA-2gvw-w6fj-7m3c","GO-2024-2728"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2728"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1062","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-argoproj-argo-cd-cve-2020-11576","parents":[{"from":"CVE-2018-21034","to":"CVE-2024-31990","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/application/application.go"],"commits":["https://github.com/argoproj/argo-cd/commit/916d4aed5775fead4ab75f47c1d352cd0e73b815","https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c","https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5"],"basis":"shared function","functions":["GetManifests"]}]},{"from":"CVE-2022-24768","to":"CVE-2024-31990","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["pkg/apis/application/v1alpha1/app_project_types.go","server/application/application.go"],"commits":["https://github.com/argoproj/argo-cd/commit/af03b291d4b7e9d3ce9a6580ae9c8141af0e05cf","https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c","https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5"],"basis":"shared function","functions":["DeleteResource","getAppResources"]}]},{"from":"CVE-2022-1025","to":"CVE-2024-31990","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["pkg/apis/application/v1alpha1/app_project_types.go","server/application/application.go"],"commits":["https://github.com/argoproj/argo-cd/commit/af03b291d4b7e9d3ce9a6580ae9c8141af0e05cf","https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c","https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5"],"basis":"shared function","functions":["DeleteResource","getAppResources"]}]},{"from":"CVE-2022-41354","to":"CVE-2024-31990","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/application/application.go"],"commits":["https://github.com/argoproj/argo-cd/commit/3a28c8a18cc2aa84fe81492625545d25c7a90bc3","https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c","https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5"],"basis":"shared function","functions":["DeleteResource","Get","GetManifests","GetManifestsWithFiles","NewServer"]}]},{"from":"CVE-2023-50726","to":"CVE-2024-31990","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/application/application.go"],"commits":["https://github.com/argoproj/argo-cd/commit/3b8f673f06c2d228e01cbc830e5cb57cef008978","https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c","https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5"],"basis":"shared function","functions":["Create"]}]},{"from":"CVE-2024-21652","to":"CVE-2024-31990","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["util/session/sessionmanager.go"],"commits":["https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d","https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b","https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c","https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5"],"basis":"shared function","functions":["expireOldFailedAttempts"]}]},{"from":"CVE-2024-21662","to":"CVE-2024-31990","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["util/session/sessionmanager.go"],"commits":["https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d","https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b","https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c","https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5"],"basis":"shared function","functions":["expireOldFailedAttempts"]}]}],"packageHistory":[{"cve":"CVE-2024-21661","published":"2024-03-18","fixed":"2.10.4","kev":false},{"cve":"CVE-2024-21662","published":"2024-03-18","fixed":"2.10.4","kev":false},{"cve":"CVE-2024-29893","published":"2024-03-29","fixed":"2.10.5","kev":false,"link":{"from":"CVE-2024-29893","to":"CVE-2024-31990","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v2","fromFixed":"2.8.14","toFixed":"2.8.16","daysApart":17}]}},{"cve":"CVE-2024-31990","published":"2024-04-15","fixed":"2.10.7","kev":false},{"cve":"CVE-2024-32476","published":"2024-04-26","fixed":"2.10.8","kev":false,"link":{"from":"CVE-2024-31990","to":"CVE-2024-32476","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v2","fromFixed":"2.10.7","toFixed":"2.10.8","daysApart":11}]}},{"cve":"CVE-2024-31989","published":"2024-05-21","fixed":"2.11.1","kev":false},{"cve":"CVE-2024-36106","published":"2024-06-06","fixed":"2.11.3","kev":false}],"package":"Go:github.com/argoproj/argo-cd/v2"}}