CVE-2022-1025

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-1025
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1025.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-1025
Aliases
Published
2022-07-12T21:15:09.277Z
Modified
2026-03-10T23:59:28.185969610Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.

References

Affected packages

Git / github.com/argoproj/argo-cd

Affected ranges

Type
GIT
Repo
https://github.com/argoproj/argo-cd
Events
Introduced
df0e2e4015c4cff4e16c8743df9d62f5ca1bdc24
Last affected
273a952e6c03c3a5e6aaa666a00a3e275128776a
Introduced
6da92a8e8103ce4145bb0fe2b7e952be79c9ff0a
Last affected
b8e154f767412172bb0c2b41131460c34d2a0c73
Introduced
fe427802293b090f43f91f5839393174df6c3b3a
Last affected
b65c1699fa2a2daa031483a3890e6911eac69068
Database specific 
{
    "versions": [
        {
            "introduced": "0.5.0"
        },
        {
            "last_affected": "2.1.12"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "last_affected": "2.2.7"
        },
        {
            "introduced": "2.3.0"
        },
        {
            "last_affected": "2.3.1"
        }
    ]
}

Affected versions

v0.*
v0.5.0
v0.5.1
v0.5.2
v0.6.0
v0.6.1
v0.7.0
v0.7.1
v0.8.0
v2.*
v2.1.0
v2.1.0-rc1
v2.1.0-rc2
v2.1.0-rc3
v2.1.1
v2.1.10
v2.1.11
v2.1.12
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.0-rc1
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.3.0
v2.3.0-rc1
v2.3.0-rc2
v2.3.0-rc4
v2.3.0-rc5
v2.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1025.json"