CVE-2022-1025

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	ArgoCD	0.5.0 through 2.1.12, 2.2.7, 2.3.1

References

https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pwwExploit, Third Party Advisory
https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pwwExploit, Third Party Advisory

Timeline

Published: Jul 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-10268.6Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including username CVE-2022-10274.8The Page Restriction WordPress (WP) WordPress plugin before 1.2.7 allows bad actors with administrator privileges to the settings page to in CVE-2022-10284.8The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its setti CVE-2022-10294.8The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with a CVE-2022-10308.8Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a special CVE-2022-10317.8Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6.CVE-2022-10327.2Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.CVE-2022-10337.8Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.CVE-2022-10347.2There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc prior to 2.10.4.CVE-2022-10355.5Segmentation Fault caused by MP4Box -lsr in GitHub repository gpac/gpac prior to 2.1.0-DEV.CVE-2022-10367.5Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior CVE-2022-10377.2The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF iss