CVE-2021-23347

MEDIUM4.7EPSS 0.22%

Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd

Published: 5/21/2021Modified: 3/13/2026

Also known as:GHSA-qq5v-f4c3-395cBIT-argo-cd-2021-23347GO-2022-0869

Description

The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.

Affected packages (3)

Bitnami/argo-cdfrom 0, < 1.7.13, >= 1.8.0, < 1.8.6
Go/github.com/argoproj/argo-cdfrom 0, < 1.7.13, >= 1.8.0, < 1.8.6
Go/github.com/argoproj/argo-cd/v2from 0, < 1.7.13

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM4.7	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-23347
WEBhttps://github.com/argoproj/argo-cd/pull/5563
WEBhttps://github.com/argoproj/argo-cd/security/advisories/GHSA-qq5v-f4c3-395c
WEBhttps://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDCMD-1078291