GitStock

argoproj/argo-cd · Security

Unauthenticated Access to sensitive settings in Argo CD

GHSA ID
GHSA-87p9-x75h-p4j2
CVE ID
CVE-2024-37152
Severity
medium
Published
Updated
CVSS
5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v3
5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

Summary

The CVE allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication.

Details

Unauthenticated Access:

Endpoint: /api/v1/settings

Description: This endpoint is accessible without any form of authentication as expected. All sensitive settings are hidden except passwordPattern.

Patches A patch for this vulnerability has been released in the following Argo CD versions:

v2.11.3 v2.10.12 v2.9.17

Impact

Unauthenticated Access:

  • Type: Unauthorized Information Disclosure.
  • Affected Parties: All users and administrators of the Argo CD instance.
  • Potential Risks: Exposure of sensitive configuration data, including but not limited to deployment settings, security configurations, and internal network information.

CWEs

  • CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-287 · Improper Authentication
  • CWE-306 · Missing Authentication for Critical Function
  • CWE-384 · Session Fixation

References

Open GitHub