CVE-2025-23216
Argo CD does not scrub secret values from patch errors
6.8
MEDIUM
CVSS 3.1
EPSS 0.46%
描述
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data. The vulnerability is fixed in v2.13.4, v2.12.10, and v2.11.13.
如何修補 CVE-2025-23216
要修補 CVE-2025-23216,請將受影響套件升級到下列已修補版本。
- —升級至 2.13.4 或更新版本
- —未列出修補版本
- —未列出修補版本
- —升級至 2.13.4 或更新版本
- —升級至 2.11.13 或更新版本
CVE-2025-23216 正在被利用嗎?
低 — EPSS 為 0.5%,目前沒有觀察到大規模利用活動。
受影響套件(5)
- from 0, < 2.13.4
- from 0, <= 1.8.7
- from 0
- >= 2.13.0, < 2.13.4
- from 0, < 2.11.13, >= 2.12.0, < 2.12.10, >= 2.13.0, < 2.13.4
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |