CVE-2024-37152

Unauthenticated Access to sensitive settings in Argo CD

HIGH 7.5EPSS 2.3%

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

Affected: argoproj · argo-cd
CVSS v3.1 NVD: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v3.1 GITHUB: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 2.35% chance of exploitation in the next 30 days, 83rd percentile
Nuclei: medium · CWE-306
Published: 2024-06-06
Updated: 2024-08-02

Nuclei templates (1)

projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-37152.yaml

Security advisories

argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2
advisories/GHSA-87p9-x75h-p4j2
argoproj/argo-cd/commit/256d90178b11b04bc8174d08d7b663a2a7b1771b

References

CVE Record
NVD entry