CVE-2025-47933

Critical

Published: 29 May 2025

Published

29 May 2025

Modified

27 August 2025

KEV Added

—

Patch

—

CVSS Score v3.1 9.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS Score 0.0007 21.0th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-47933 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Argoproj Argo Cd. Its CVSS base score is 9.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Cloud Accounts (T1078.004); ranked at the 21.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-16408

Vulnerability details

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols…

in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1078.004 Cloud Accounts Stealth

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

attack.mitre.org →

T1539 Steal Web Session Cookie Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

attack.mitre.org →

T1555.003 Credentials from Web Browsers Credential Access

Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

attack.mitre.org →

T1609 Container Administration Command Execution

Adversaries may abuse a container administration service to execute commands within a container.

attack.mitre.org →

T1651 Cloud Administration Command Execution

Adversaries may abuse cloud management services to execute commands within virtual machines.

attack.mitre.org →

Why these techniques?

XSS allows JavaScript execution in victim's browser context, enabling session cookie theft (T1539, T1555.003) for valid cloud account abuse (T1078.004) and arbitrary API calls to create/modify/delete Kubernetes resources (T1609, T1651).