{"metadata": {"vulnerability": "GHSA-274V-MGCV-CM8J", "count": 4, "kinds": {"milestone": 1, "sighting": 2, "kev": 0, "other": 1}}, "data": [{"timestamp": "2025-01-30T17:51:33Z", "date_only": false, "value": "2025-01-30T17:51:33Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-274V-MGCV-CM8J", "field": "published"}, {"timestamp": "2025-01-30T18:12:25Z", "date_only": false, "value": "2025-01-30T18:12:25.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/3500", "record": "GHSA-274V-MGCV-CM8J", "field": "creation_timestamp", "uuid": "15ed3a78-abf3-45aa-9dc4-1eee9a25edf8", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: GHSA-47g2-qmh2-749v\n\ud83d\udd25 CVSS Score: 5.9 (CVSS_V3)\n\ud83d\udd39 Description: ### Impact\n\nA vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. \n\nThe vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data.\n\n### Patches\nA patch for this vulnerability is available in the following Argo CD versions:\n- v2.13.4\n- v2.12.10\n- v2.11.13\n\n### Workarounds\nThere is no workaround other than upgrading.\n\n### References\nFixed with commit https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107 & https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca\n\n\ud83d\udccf Published: 2025-01-30T17:52:45Z\n\ud83d\udccf Modified: 2025-01-30T17:52:45Z\n\ud83d\udd17 References:\n1. https://github.com/argoproj/argo-cd/security/advisories/GHSA-47g2-qmh2-749v\n2. https://github.com/argoproj/gitops-engine/security/advisories/GHSA-274v-mgcv-cm8j\n3. https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107\n4. https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca\n5. https://github.com/argoproj/argo-cd", "url": "https://t.me/DarkWebInformer_CVEAlerts/3500"}, {"timestamp": "2025-01-30T18:12:30Z", "date_only": false, "value": "2025-01-30T18:12:30.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/3502", "record": "GHSA-274V-MGCV-CM8J", "field": "creation_timestamp", "uuid": "01cb136c-c762-44de-899b-db36167ecffc", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: GHSA-274v-mgcv-cm8j\n\ud83d\udd25 CVSS Score: 5.9 (CVSS_V3)\n\ud83d\udd39 Description: ### Impact\nA vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. \n\nThe vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data.\n\n### Patches\nA patch for this vulnerability is available in the following Argo CD versions:\n- v2.13.4\n- v2.12.10\n- v2.11.13\n\n### Workarounds\nThere is no workaround other than upgrading.\n\n### References\nFixed with commit https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107 & https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca\n\n\ud83d\udccf Published: 2025-01-30T17:51:33Z\n\ud83d\udccf Modified: 2025-01-30T17:51:33Z\n\ud83d\udd17 References:\n1. https://github.com/argoproj/argo-cd/security/advisories/GHSA-47g2-qmh2-749v\n2. https://github.com/argoproj/gitops-engine/security/advisories/GHSA-274v-mgcv-cm8j\n3. https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107\n4. https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca\n5. https://github.com/argoproj/gitops-engine", "url": "https://t.me/DarkWebInformer_CVEAlerts/3502"}, {"timestamp": "2025-12-20T03:10:36Z", "date_only": false, "value": "2025-12-20T03:10:36Z", "kind": "other", "label": "Updated", "source": "github", "record": "GHSA-274V-MGCV-CM8J", "field": "modified"}]}