CVE-2024-37152

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd

# Summary The CVE allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. # Details ## **Unauthenticated Access:** ### Endpoint: /api/v1/settings Description: This endpoint is accessible without any form of authentication as expected. All sensitive settings are hidden except `passwordPattern`. Patches A patch for this vulnerability has been released in the following Argo CD versions: v2.11.3 v2.10.12 v2.9.17 # Impact ## Unauthenticated Access: * Type: Unauthorized Information Disclosure. * Affected Parties: All users and administrators of the Argo CD instance. * Potential Risks: Exposure of sensitive configuration data, including but not limited to deployment settings, security configurations, and internal network information.

Argo CD es una herramienta declarativa de entrega continua de GitOps para Kubernetes. La vulnerabilidad permite el acceso no autorizado a la configuración confidencial expuesta por el endpoint /api/v1/settings sin autenticación. Todas las configuraciones confidenciales están ocultas excepto el patrón de contraseña. Esta vulnerabilidad se solucionó en 2.11.3, 2.10.12 y 2.9.17.