PT-2023-13975 · Argo Cd · Argo Cd

Bean.Zhang

·

Published

2023-03-23

·

Updated

2024-08-20

·

CVE-2022-41354

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Argo CD versions 0.5.0 through 2.4.12 Argo CD versions 2.5.0 through 2.5.15 Argo CD versions 2.6.0 through 2.6.6
Description An access control issue in Argo CD allows unauthorized users to enumerate existing applications by inspecting API error messages. This could be used as a starting point for further attacks, such as social engineering to gain higher privileges. Many Argo CD API endpoints accept an application name as a parameter, and by trial and error, an attacker can infer which applications exist and which do not. The issue affects all versions of Argo CD starting with v0.5.0.
Recommendations For Argo CD versions 0.5.0 through 2.4.12, upgrade to version 2.4.28 or later. For Argo CD versions 2.5.0 through 2.5.15, upgrade to version 2.5.16 or later. For Argo CD versions 2.6.0 through 2.6.6, upgrade to version 2.6.7 or later. As a general precaution, review API client code to ensure it can handle the changed API behavior properly, which now returns "unauthorized" for both missing applications and unauthorized access.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2022-41354
GHSA-2Q5C-QW9C-FMVQ
GO-2023-1670

Affected Products

Argo Cd