CVE-2020-11576

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise.

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise.

Observable Discrepancy in Argo in github.com/argoproj/argo-cd

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise. ### Specific Go Packages Affected github.com/argoproj/argo-cd/util/session github.com/argoproj/argo-cd/server/session

Arreglado en v1.5.1, Argo versión v1.5.0 era vulnerable a una vulnerabilidad de enumeración de usuarios que permitía a los atacantes determinar los nombres de usuario de cuentas válidas (no SSO) porque / api / v1 / session devolvió 401 para un nombre de usuario existente y 404 de lo contrario .