CVE-2024-37152
Unauthenticated Access to sensitive settings in Argo CD
Résumé
Unauthenticated Access to sensitive settings in Argo CD
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
argo-cd
[{"type":"SEMVER","events":[{"introduced":"2.9.3"},{"fixed":"2.11.3"}]}]
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com