{"api_version":"1","generated_at":"2026-07-24T05:04:23+00:00","cve":"CVE-2022-24348","urls":{"html":"https://cve.report/CVE-2022-24348","api":"https://cve.report/api/cve/CVE-2022-24348.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-24348","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-24348"},"summary":{"title":"CVE-2022-24348","description":"Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2022-02-04 21:15:00","updated_at":"2022-02-09 13:53:00"},"problem_types":["CWE-22"],"metrics":[],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7","name":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7","refsource":"CONFIRM","tags":[],"title":"Path traversal and dereference of symlinks when passing Helm value files · Advisory · argoproj/argo-cd · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments/","name":"https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments/","refsource":"MISC","tags":[],"title":"Malicious Kubernetes Helm Charts can be used to steal sensitive information from Argo CD deployments","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24348","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24348","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"24348","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"linuxfoundation","cpe5":"argo-cd","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2022-24348","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"refsource":"MISC","name":"https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments/","url":"https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments/"},{"refsource":"CONFIRM","name":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7","url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7"}]}},"nvd":{"publishedDate":"2022-02-04 21:15:00","lastModifiedDate":"2022-02-09 13:53:00","problem_types":["CWE-22"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH"},"exploitabilityScore":3.1,"impactScore":4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:linuxfoundation:argo-cd:*:*:*:*:*:*:*:*","versionEndExcluding":"2.1.9","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:linuxfoundation:argo-cd:*:*:*:*:*:*:*:*","versionStartIncluding":"2.2.0","versionEndExcluding":"2.2.4","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"24348","Ordinal":"227673","Title":"CVE-2022-24348","CVE":"CVE-2022-24348","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"24348","Ordinal":"1","NoteData":"Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.","Type":"Description","Title":null},{"CveYear":"2022","CveId":"24348","Ordinal":"2","NoteData":"2022-02-04","Type":"Other","Title":"Published"},{"CveYear":"2022","CveId":"24348","Ordinal":"3","NoteData":"2022-02-04","Type":"Other","Title":"Modified"}]}}}