fkie_cve-2024-37152

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

GHSA-87p9-x75h-p4j2 — Unauthenticated Access to sensitive settings in Argo CD

Affected: Go: github.com/argoproj/argo-cd/v2/server

# Summary The CVE allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication.

# Details ## **Unauthenticated Access:**

### Endpoint: /api/v1/settings Description: This endpoint is accessible without any form of authentication as expected. All sensitive settings are hidden except `passwordPattern`.

Patches A patch for this vulnerability has been released in the following Argo CD versions:

v2.11.3 v2.10.12 v2.9.17

# Impact ## Unauthenticated Access:

* Type: Unauthorized Information Disclosure. * Affected Parties: All users and administrators of the Argo CD instance. * Potential Risks: Exposure of sensitive configuration data, including but not limited to deployment settings, security configurations, and internal network information.

Most recent entries from all

bdu:2024-05984

fkie_cve-2024-37152

GHSA-87p9-x75h-p4j2 — Unauthenticated Access to sensitive settings in Argo CD