Описание
In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.
Ссылки
- ExploitIssue TrackingThird Party Advisory
- ExploitPatchThird Party Advisory
- ExploitIssue TrackingThird Party Advisory
- ExploitPatchThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.1.3 (включая)
cpe:2.3:a:argo-workflows_project:argo-workflows:*:*:*:*:*:*:*:*
EPSS
Процентиль: 50%
0.00271
Низкий
6.5 Medium
CVSS3
5.8 Medium
CVSS2
Дефекты
CWE-20
Связанные уязвимости
EPSS
Процентиль: 50%
0.00271
Низкий
6.5 Medium
CVSS3
5.8 Medium
CVSS2
Дефекты
CWE-20