BIT-argo-cd-2024-37152

vendorUSosv

Unauthenticated Access to sensitive settings in Argo CD

view advisory published 2024-06-08Licence: per source

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-37152US	high7.5OT elevated	2.35% (84th)	—	2024-06-06
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoi…

references

External citations — patches, advisories, analysis.

https://github.com/argoproj/argo-cd/commit/256d90178b11b04bc8174d08d7b663a2a7b1771bFIX
https://github.com/argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2024-37152WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan