CVE-2022-24905

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was found in Argo CD prior to versions 2.3.4, 2.2.9, and 2.1.15 that allows an attacker to spoof error messages on the login screen when single sign on (SSO) is enabled. In order to exploit this vulnerability, an attacker would have to trick the victim to visit a specially crafted URL which contains the message to be displayed. As far as the research of the Argo CD team concluded, it is not possible to specify any active content (e.g. Javascript) or other HTML fragments (e.g. clickable links) in the spoofed message. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. There are currently no known workarounds.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: May 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-249064.3Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is ex CVE-2022-249077.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User intera CVE-2022-249087.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User intera CVE-2022-24918.8A vulnerability has been found in SourceCodester Library Management System 1.0 and classified as critical. This vulnerability affects unknow CVE-2022-249106.7A buffer overflow vulnerability exists in the httpd parse_ping_result API functionality of InHand Networks InRouter302 V3.5.4. A specially-c CVE-2022-249127.5The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event val CVE-2022-249135.5Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider CVE-2022-249158.8The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code CVE-2022-249167.5Optimism before @eth-optimism/l2geth@0.5.11 allows economic griefing because a balance is duplicated upon contract self-destruction.CVE-2022-249174.4An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload CVE-2022-249184.4An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can CVE-2022-249194.4An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload ca