CVE-2018-21034

In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 70%
VendorProductVersion
argoprojargo_cd
𝑥
≤ 1.4.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/argoproj/argo-cd/blob/a1afe44066fcd0a0ab90a02a23177164bbad42cf/util/diff/diff.go#L399
https://github.com/argoproj/argo-cd/issues/470
https://github.com/argoproj/argo-cd/pull/3088
https://www.soluble.ai/blog/argo-cves-2020
https://github.com/argoproj/argo-cd/blob/a1afe44066fcd0a0ab90a02a23177164bbad42cf/util/diff/diff.go#L399
https://github.com/argoproj/argo-cd/issues/470
https://github.com/argoproj/argo-cd/pull/3088
https://www.soluble.ai/blog/argo-cves-2020