Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-21034

In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.

Published

2020-04-09T17:15:12.703

Last Modified

2024-11-21T04:02:44.707

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-200

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	argoproj	argo_cd	≤ 1.4.2	Yes

References

https://github.com/argoproj/argo-cd/blob/a1afe44066fcd0a0ab90a02a23177164bbad42cf/util/diff/diff.go#L399 Exploit, Third Party Advisory ([email protected])
https://github.com/argoproj/argo-cd/issues/470 Third Party Advisory ([email protected])
https://github.com/argoproj/argo-cd/pull/3088 Patch, Third Party Advisory ([email protected])
https://www.soluble.ai/blog/argo-cves-2020 Exploit, Third Party Advisory ([email protected])
https://github.com/argoproj/argo-cd/blob/a1afe44066fcd0a0ab90a02a23177164bbad42cf/util/diff/diff.go#L399 Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/argoproj/argo-cd/issues/470 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/argoproj/argo-cd/pull/3088 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.soluble.ai/blog/argo-cves-2020 Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)