CVE-2018-21034

MEDIUM

Argo CD < 1.5.0-rc1 - Authenticated Exposure of Sensitive Information via API

Title source: llm
STIX 2.1

Description

In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.

References (4)

Core 4
Core References
Third Party Advisory x_refsource_misc
https://github.com/argoproj/argo-cd/issues/470
Patch, Third Party Advisory x_refsource_misc
https://github.com/argoproj/argo-cd/pull/3088
Exploit, Third Party Advisory x_refsource_misc
https://www.soluble.ai/blog/argo-cves-2020

Scores

CVSS v3 6.5
EPSS 0.0137
EPSS Percentile 68.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (2)
argoproj/argo-cd 0 - 1.5.0-rc1Go
argoproj/argo_cd < 1.4.2
Published Apr 09, 2020
Tracked Since Feb 18, 2026