PT-2020-8679 · Argo · Argo

Eriner · Published 2020-04-09 · Updated 2024-08-20 · CVE-2018-21034

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Argo versions prior to v1.5.0-rc1

Description The issue allows authenticated Argo users to submit API calls to retrieve secrets and other manifests stored within git.

Recommendations For versions prior to v1.5.0-rc1, update to version v1.5.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information stored within git until the update is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-21034

GHSA-XJ7V-C82W-92Q2

GO-2023-1952

Affected Products

Argo

References · 13

• 🔥 https://github.com/argoproj/argo-cd/blob/a1afe44066fcd0a0ab90a02a23177164bbad42cf/util/diff/diff.go#L399 · Exploit
• 🔥 https://soluble.ai/blog/argo-cves-2020 · Exploit
• https://github.com/argoproj/argo-cd/pull/3088 · Patch
• https://osv.dev/vulnerability/GO-2023-1952 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-21034 · Security Note
• https://osv.dev/vulnerability/CVE-2018-21034 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xj7v-c82w-92q2 · Vendor Advisory
• https://github.com/argoproj/argo-cd · Note
• https://github.com/argoproj/argo-cd/issues/470 · Note
• https://github.com/argoproj/argo-cd/commit/916d4aed5775fead4ab75f47c1d352cd0e73b815 · Note
• https://github.com/advisories/GHSA-xj7v-c82w-92q2 · Note
• https://t.me/cvenotify/89699 · Telegram Post
• https://t.me/cvenotify/2627 · Telegram Post