CVE-2022-41354

Published: Mar 27, 2023Modified: Jul 9, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.

Affected (3)

Products: Linuxfoundation: Argo Cd

Linuxfoundation

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Linuxfoundation Argo Cd	From 0.5.0 to 2.4.28
Linuxfoundation Argo Cd	From 2.5.0 to 2.5.16
Linuxfoundation Argo Cd	From 2.6.0 to 2.6.7

Related CWEs

Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (4)

https://github.com/argoproj/argo-cd/security/advisories/GHSA-2q5c-qw9c-fmvq

Source: cve@mitre.org

Vendor Advisory

https://github.com/chunklhit/cve/blob/master/argo/argo-cd/application_enumeration.md

Source: cve@mitre.org

Broken Link

https://github.com/argoproj/argo-cd/security/advisories/GHSA-2q5c-qw9c-fmvq

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://github.com/chunklhit/cve/blob/master/argo/argo-cd/application_enumeration.md

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.