CVE-2024-37152
highPriorität · verfolgen · 31OT-Risiko · erhöhtEPSS 0.023 · 84. PerzentilEURUUSEPSS · bewertet 2026-10-27
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.3–7.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (17)
Betroffene Produkte und Versionsbereiche.
- Go github.com/argoproj/argo-cd/v2/server2.10.0 → 2.10.12osvUSpkg:golang/github.com/argoproj/argo-cd/v2/server
- Go github.com/argoproj/argo-cd/v2/server2.11.0 → 2.11.3osvUSpkg:golang/github.com/argoproj/argo-cd/v2/server
- Go github.com/argoproj/argo-cd/v2/server2.9.3 → 2.9.17osvUSpkg:golang/github.com/argoproj/argo-cd/v2/server
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-87p9-x75h-p4j2Unauthenticated Access to sensitive settings in Argo CD2024-06-06ghsa · osvUS
# Summary The CVE allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. # Details ## **Unauthenticated Access:** ### Endpoint: /api/v1/settings Description: This endpoint is accessible without any form of authentication as expected. All sensitive settings are hidden except `passwordPattern`. Patches A patch for this vulnerability has been released in the following Argo CD versions: v2.11.3 v2.10.12 v2.9.17 # Impact ## Unauthenticated Access: * Type: Unauthorized Information Disclosure. * Affected Parties: All users and administrators of the Argo CD instance. * Potential Risks: Exposure of sensitive configuration data, including but not limited to deployment settings, security configurations, and internal network information.
- BIT-argo-cd-2024-37152Unauthenticated Access to sensitive settings in Argo CD2024-06-08vendor · osvUS
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
- GO-2024-2902Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd2024-06-14vendor · osvUS
Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202406-460cnnvd
- EUVD-2024-1978enisa_euvd
- BDU:2024-05984fstec_bdu
- GHSA-87p9-x75h-p4j2enisa_euvd
- BIT-argo-cd-2024-37152osv
- GHSA-87p9-x75h-p4j2osv
- GO-2024-2902osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (7)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2024-37152/cnnvd
- https://github.com/argoproj/argo-cd/commit/256d90178b11b04bc8174d08d7b663a2a7b1771bcnnvd
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2cnnvd
- https://github.com/argoproj/argo-cd/commit/256d90178b11b04bc8174d08d7b663a2a7b1771benisa_euvd
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2enisa_euvd
- https://github.com/argoproj/argo-cd/commit/256d90178b11b04bc8174d08d7b663a2a7b1771bPatchnvd
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2Vendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan