Database/Container, Kubernetes & orchestration
Argo CD: Predictable SSO state values allow authentication bypass during login
CVSS 8.3CVE-2022-31034Container, Kubernetes & orchestrationcurated
Impact
Predictable SSO state values allow authentication bypass during login
Who can reach it
Unauthenticated network in a position to observe or race a login
What to do
Rolling Argo CD upgrade
References
Related entries
- Argo CD: Improper certificate validation lets Argo CD be tricked into trusting a hostile endpointCVE-2022-31105 · Argo CDHigh
- Argo CD: CSRF against the Argo CD API allows deploying arbitrary workloads with Argo's cluster-admin rightsCVE-2024-22424 · Argo CDHigh
- Argo CD: Directory traversal via Helm charts discloses credentials from other Applications' value filesCVE-2022-24348 · Argo CDHigh
- Argo CD: Path traversal plus improper access control in the repo-serverCVE-2022-24730 · Argo CDHigh
- Argo CD: /api/version leaks internal system information without authenticationCVE-2021-26923 · Argo CDHigh
- Argo CD: Large JSON payload to /api/webhook DoSes the API server from an unauthenticated positionCVE-2024-40634 · Argo CDHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.