Argo CD allows authenticated users to enumerate clusters by name (argoproj argo-cd)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.41 % · percentile 35 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
Weaknesses (CWE)
- CWE-209 — Generation of Error Message Containing Sensitive Information
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | GitHub_M |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-3cqf-953p-h5cp — Argo-cd authenticated users can enumerate clusters by name
- GO-2024-2898 — Argo-cd authenticated users can enumerate clusters by name in github.com/argoproj/argo-cd
European references
- ENISA EUVD · EUVD-2024-1898
- GCVE · GCVE-0-2024-36106
Affected configurations (NVD CPE)
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*> 0.11.0 < 2.9.17cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*≥ 2.10.0 < 2.10.12cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*≥ 2.11.0 < 2.11.3
Affected products
| Product | Versions |
|---|---|
| argoproj · argo-cd | affected > 0.11.0, < 2.9.17 ; affected >= 2.10.0, < 2.10.12 ; affected >= 2.11.0, < 2.11.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |