Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2025-23216
Analyzed
More InfoOfficial Page
Source-security-advisories@github.com
View Known Exploited Vulnerability (KEV) details
Published At-30 Jan, 2025 | 16:15
Updated At-06 Jun, 2025 | 15:44

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data. The vulnerability is fixed in v2.13.4, v2.12.10, and v2.11.13.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.16.8MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Primary3.16.8MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Type: Secondary
Version: 3.1
Base score: 6.8
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Type: Primary
Version: 3.1
Base score: 6.8
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CPE Matches

argoproj
argoproj
>>argo_cd>>Versions before 2.11.13(exclusive)
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
argoproj
argoproj
>>argo_cd>>Versions from 2.12.0(inclusive) to 2.12.10(exclusive)
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
argoproj
argoproj
>>argo_cd>>Versions from 2.13.0(inclusive) to 2.13.4(exclusive)
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-200Primarysecurity-advisories@github.com
CWE-209Primarysecurity-advisories@github.com
CWE-209Primarynvd@nist.gov
CWE ID: CWE-200
Type: Primary
Source: security-advisories@github.com
CWE ID: CWE-209
Type: Primary
Source: security-advisories@github.com
CWE ID: CWE-209
Type: Primary
Source: nvd@nist.gov
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107security-advisories@github.com
Patch
https://github.com/argoproj/argo-cd/security/advisories/GHSA-47g2-qmh2-749vsecurity-advisories@github.com
Vendor Advisory
Patch
https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddcasecurity-advisories@github.com
Patch
Hyperlink: https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/argoproj/argo-cd/security/advisories/GHSA-47g2-qmh2-749v
Source: security-advisories@github.com
Resource:
Vendor Advisory
Patch
Hyperlink: https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca
Source: security-advisories@github.com
Resource:
Patch
Change History
0Changes found

Details not found