Improper Privilege Management Affecting github.com/argoproj/argo-cd/v2/server/application package, versions <2.8.12 >=2.9.0-rc1 <2.9.8 >2.10.0-rc1 <2.10.3
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDV2SERVERAPPLICATION-6438493
- published 14 Mar 2024
- disclosed 13 Mar 2024
- credit Michael Crenshaw
Introduced: 13 Mar 2024
CVE-2023-50726 Open this link in a new tabHow to fix?
Upgrade github.com/argoproj/argo-cd/v2/server/application to version 2.8.12, 2.9.8, 2.10.3 or higher.
Overview
github.com/argoproj/argo-cd/v2/server/application is a declarative, GitOps continuous delivery tool for Kubernetes.
Affected versions of this package are vulnerable to Improper Privilege Management for the Local Sync command. A user can perform unauthorized actions by exploiting the privileges associated with the create permission without needing the override permission.
Workaround
This vulnerability can be avoided by removing applications, create RBAC access from the relevant users.