Detections
Analytics
SCA: security update for github.com/argoproj/argo-cd (GHSA-r9cr-hvjj-496v)
medium Tenable Self-Hosted Container Security Plugin ID 418627
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version
1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an
improper access control bug, allowing a malicious user with read-only repository access to leak sensitive
files from Argo CD's repo-server. A malicious Argo CD user who has been granted `get` access for a
repository containing a Helm chart can craft an API request to the
`/api/v1/repositories/{repo_url}/appdetails` endpoint to leak the contents of out-of-bounds files from the
repo-server. The malicious payload would reference an out-of-bounds file, and the contents of that file
would be returned as part of the response. Contents from a non-YAML file may be returned as part of an
error message. The attacker would have to know or guess the location of the target file. Sensitive files
which could be leaked include files from other Applications' source repositories or any secrets which have
been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6,
and 2.3.0. The patches prevent path traversal and limit access to users who either A) have been granted
Application `create` privileges or B) have been granted Application `get` privileges and are requesting
details for a `repo_url` that has already been used for the given Application. There are currently no
known workarounds. (CVE-2022-24730)
See Also
Plugin Details
Severity: Medium
ID: 418627
Version: Revision 1.8
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS Score Source: CVE-2022-24730
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 3/24/2022
Vulnerability Publication Date: 3/23/2022
Reference Information
CVE: CVE-2022-24730