Showing 2 vulnerabilities on this page for argo-cd

Signals CISA KEV Ransomware Nuclei
linuxfoundation vulnerability results
VulnerabilityTitle and contextCVSSEPSSPoCsSignalsSTIX action

Unauthenticated Access to sensitive settings in Argo CD

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

CWE-22CWE-287CWE-306CWE-384Jun 6, 20241 related artifact
CVSS5.3v3.1EPSS2.35%PoCs0SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei templateSTIX

Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combined with other vulnerabilities to attack the default admin account. This flaw undermines a patch for CVE-2020-8827 intended to protect against brute-force attacks. The application's brute force protection

CWE-307Mar 18, 2024
CVSS7.5v3.1EPSS0.838%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX