CVE-2025-47933 Common Vulnerabilities and Exposures

Upstream information

CVE-2025-47933 at MITRE

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v3 Scores
CVSS detail	CNA (GitHub)	National Vulnerability Database	SUSE
Base Score	9	5.4	8.2
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L
Attack Vector	Network	Network	Network
Attack Complexity	Low	Low	Low
Privileges Required	Low	Low	Low
User Interaction	Required	Required	Required
Scope	Changed	Changed	Changed
Confidentiality Impact	High	Low	Low
Integrity Impact	High	Low	High
Availability Impact	High	None	Low
CVSSv3 Version	3.1	3.1	3.1

SUSE Bugzilla entry: 1243791 [NEW]

SUSE Security Advisories:

openSUSE-SU-2025:15188-1, published Mon Jun 2 18:51:31 2025

List of released packages

Product(s)	Fixed package version(s)	References
Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE	`libgnutls30 >= 3.8.3-slfo.1.1_5.1`
Image SL-Micro Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow	`gnutls >= 3.8.3-slfo.1.1_5.1` `libgnutls30 >= 3.8.3-slfo.1.1_5.1`
SUSE Linux Enterprise Server 16.0	`govulncheck-vulndb >= 0.0.20250814T182633-160000.1.2`	Patchnames: SUSE Linux Enterprise Server 16.0 GA govulncheck-vulndb-0.0.20250814T182633-160000.1.2
openSUSE Tumbleweed	`govulncheck-vulndb >= 0.0.20250529T205903-1.1`	Patchnames: openSUSE-Tumbleweed-2025-15188

SUSE Timeline for this CVE

CVE page created: Wed May 28 20:00:03 2025
CVE page last modified: Tue Dec 16 12:53:53 2025