UpHeron
All vulnerabilities

Servers and applications

CVE-2022-31035

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a `javascript:` link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). The script would be capable of doing anything…

Severity
Medium 5.4
Published
27 Jun 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.1.16
Sources
NVD

Affected software

SoftwareAffected versions
Argo CDServers and applications · cpe:a:argoproj:argo_cd
  • From 1.0.0 before 2.1.16
  • Version 2.2.9
  • Version 2.3.4
  • Version 2.4.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-31035
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-31035