PT-2020-12695 · Intuit · Argo

Published 2020-04-08 · Updated 2024-08-21 · CVE-2020-11576

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Argo version v1.5.0

Description The issue allowed attackers to determine the usernames of valid (non-SSO) accounts. This was possible because the /api/v1/session endpoint returned a 401 status code for an existing username and a 404 status code otherwise. The vulnerability is related to user enumeration.

Recommendations For Argo version v1.5.0, update to version v1.5.1 to resolve the issue. As a temporary workaround, consider restricting access to the /api/v1/session endpoint to minimize the risk of exploitation.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

BIT-ARGO-CD-2020-11576

CVE-2020-11576

GHSA-VJ54-CJRX-X696

GO-2022-0882

Affected Products

Argo

References · 10

• https://github.com/argoproj/argo-cd/commit/35a7350b7444bcaf53ee0bb11b9d8e3ae4b717a1 · Patch
• https://github.com/argoproj/argo-cd/pull/3215 · Patch
• https://osv.dev/vulnerability/GHSA-vj54-cjrx-x696 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-argo-cd-2020-11576 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11576 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11576 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0882 · Vendor Advisory
• https://github.com/advisories/GHSA-vj54-cjrx-x696 · Note
• https://soluble.ai/blog/argo-cves-2020 · Note
• https://t.me/cvenotify/89695 · Telegram Post