CVE-2022-31102 Cross-site Scripting for Argo CD single sign on users

What is CVE-2022-31102?

CVE-2022-31102 is a low-severity cross-site scripting vulnerability in Argoproj Argo Cd, published on 12 Jul 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with 2.3.0 and prior to 2.3.6 and 2.4.5 is vulnerable to a cross-site scripting (XSS) bug which could allow an attacker to inject arbitrary JavaScript in the `/auth/callback` page in a victim's browser. This vulnerability only affects Argo CD instances which have single sign on (SSO) enabled. The exploit also assumes the attacker has 1) access to the API server's encryption key, 2) a method to add a cookie to the victim's browser, and 3) the ability to convince the victim to visit a malicious `/auth/callback` link. The vulnerability is classified as low severity because access to the API server's encryption key already grants a high level of access. Exploiting the XSS would allow the attacker to impersonate the victim, but would not grant any privileges which the attacker could not otherwise gain using the encryption key. A patch for this vulnerability has been released in the following Argo CD versions 2.4.5 and 2.3.6. There is currently no known workaround.

Weakness: CWE-79

Which versions are affected by CVE-2022-31102?

6 open source packages ship an affected version, including github.com/argoproj/argo-cd and github.com/argoproj/argo-cd/v2. It affects 1 product.

Products include Argoproj Argo Cd.

How do I fix CVE-2022-31102?

Upgrade github.com/argoproj/argo-cd to a fixed version for your release line: 2.3.6 or 2.4.5.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-31102 being exploited?

There is no known exploitation of CVE-2022-31102 in the wild and no public exploit code.

Other vulnerabilities in Argoproj Argo Cd

• CVE-2025-55190 Argo CD: Project API Token Exposes Repository Credentials Critical 10.0
• CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled Critical 10.0
• CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD Critical 9.9
• CVE-2022-24768 Improper access control allows admin privilege escalation in Argo CD Critical 9.9
• CVE-2024-21652 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss Critical 9.8

All Argoproj Argo Cd vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pmjg-52h9-72qv, GO-2022-0517.