Argo CD allows authenticated users to enumerate clusters by name (argoproj argo-cd)
En bref
- Source
- NVD
- EPSS
- EPSS 0.41 % · centile 35 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Modified
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
Faiblesses (CWE)
- CWE-209 — Message d'erreur contenant des informations sensibles
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | GitHub_M |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-3cqf-953p-h5cp — Argo-cd authenticated users can enumerate clusters by name
- GO-2024-2898 — Argo-cd authenticated users can enumerate clusters by name in github.com/argoproj/argo-cd
Références européennes
- ENISA EUVD · EUVD-2024-1898
- GCVE · GCVE-0-2024-36106
Configurations affectées (CPE NVD)
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*> 0.11.0 < 2.9.17cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*≥ 2.10.0 < 2.10.12cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*≥ 2.11.0 < 2.11.3
Produits affectés
| Produit | Versions |
|---|---|
| argoproj · argo-cd | affected > 0.11.0, < 2.9.17 ; affected >= 2.10.0, < 2.10.12 ; affected >= 2.11.0, < 2.11.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |