CVE-2021-23347

MEDIUM4.7EPSS 0.22%

Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd

發布日:2021/5/21修改日:2026/3/13

也稱為:GHSA-qq5v-f4c3-395cBIT-argo-cd-2021-23347GO-2022-0869

描述

The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.

受影響套件(3)

Bitnami/argo-cdfrom 0, < 1.7.13, >= 1.8.0, < 1.8.6
Go/github.com/argoproj/argo-cdfrom 0, < 1.7.13, >= 1.8.0, < 1.8.6
Go/github.com/argoproj/argo-cd/v2from 0, < 1.7.13

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM4.7	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

參考連結(4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-23347
WEBhttps://github.com/argoproj/argo-cd/pull/5563
WEBhttps://github.com/argoproj/argo-cd/security/advisories/GHSA-qq5v-f4c3-395c
WEBhttps://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDCMD-1078291