CVE-2025-23216: Github.com/argoproj/argo cd/v2 Argo CD Does Not Scrub Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-47g2-qmh2-749v",
  "modified" : "2025-02-05T16:21:44Z",
  "published" : "2025-01-30T17:52:45Z",
  "aliases" : [ "CVE-2025-23216" ],
  "summary" : "Argo CD does not scrub secret values from patch errors",
  "details" : "### Impact\n\nA vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. \n\nThe vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data.\n\n### Patches\nA patch for this vulnerability is available in the following Argo CD versions:\n- v2.13.4\n- v2.12.10\n- v2.11.13\n\n### Workarounds\nThere is no workaround other than upgrading.\n\n### References\nFixed with commit https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107 & https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/argoproj/argo-cd/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.13.0"
      }, {
        "fixed" : "2.13.4"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/argoproj/argo-cd/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.12.0"
      }, {
        "fixed" : "2.12.10"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/argoproj/argo-cd/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.11.13"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/argoproj/argo-cd"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "1.8.7"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/argoproj/argo-cd/security/advisories/GHSA-47g2-qmh2-749v"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/argoproj/gitops-engine/security/advisories/GHSA-274v-mgcv-cm8j"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-23216"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/argoproj/argo-cd"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200", "CWE-209" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-01-30T17:52:45Z",
    "nvd_published_at" : "2025-01-30T16:15:31Z"
  }
}