Database/Container, Kubernetes & orchestration
Argo CD: Chained DoS plus in-memory data manipulation lets an attacker bypass authentication
CVSS 9.8CVE-2024-21652Container, Kubernetes & orchestrationcurated
Impact
Chained DoS plus in-memory data manipulation lets an attacker bypass authentication
Who can reach it
Unauthenticated network reaching the Argo CD API
What to do
Rolling Argo CD upgrade to 2.8.13/2.9.9/2.10.4+
References
Related entries
- Argo CD: Improper authorization lets a user modify resources outside their permitted projectsCVE-2023-23947 · Argo CDCritical
- Argo CD: Stored XSS via a `javascript:` link executes in an admin's browserCVE-2022-31035 · Argo CDCritical
- Argo CD: Improper authorization causes the API to accept tokens it should rejectCVE-2023-22482 · Argo CDCritical
- Argo CD: Improper URL protocol filtering in link annotations enables client-side attacks against adminsCVE-2024-28175 · Argo CDCritical
- Argo CD: An unprivileged pod in any namespace can reach the unauthenticated Argo CD Redis on 6379 and poisonCVE-2024-31989 · Argo CDCritical
- Argo CD: Improper access control lets any user escalate to admin-levelCVE-2022-1025 · Argo CDHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.