CVE-2024-36106

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Its possible for authenticated users to enumerate clusters by name by inspecting error messages. Its also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
GitHub_MCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
VendorProductVersion
argoprojargo_cd
0.11.0 <
𝑥
< 2.9.17
argoprojargo_cd
2.10.0 ≤
𝑥
< 2.10.12
argoprojargo_cd
2.11.0 ≤
𝑥
< 2.11.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/argoproj/argo-cd/commit/c2647055c261a550e5da075793260f6524e65ad9
https://github.com/argoproj/argo-cd/security/advisories/GHSA-3cqf-953p-h5cp
https://github.com/argoproj/argo-cd/commit/c2647055c261a550e5da075793260f6524e65ad9
https://github.com/argoproj/argo-cd/security/advisories/GHSA-3cqf-953p-h5cp