Vulnerability · Published Feb 16, 2022 · Assigned by redhat
CVE-2021-3557
Medium 6.5
In plain English
A medium-severity incorrect permission assignment in argocd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.8%top 44.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster including all secrets which might enable privilege escalations. The highest threat from this vulnerability is to data confidentiality.
Affected products (as reported)
Weakness: CWE-732
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1961929 x_refsource_MISC