CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-40584 – Denial of Service to Argo CD repo-server
https://notcve.org/view.php?id=CVE-2023-40584
Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious, low-privileged user can send a malicious tar.gz file that exploits this vulnerability to the repo-server, thereby harming the system's functionality and availability. Additionally, the repo-server is susceptible to another vulnerability due to the fact that it does not check the extracted file permissions before attempting to delete them. • https://github.com/argoproj/argo-cd/commit/b8f92c4ff226346624f43de3f25d81dac6386674 https://github.com/argoproj/argo-cd/security/advisories/GHSA-g687-f2gx-6wm8 https://access.redhat.com/security/cve/CVE-2023-40584 https://bugzilla.redhat.com/show_bug.cgi?id=2236530 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.9EPSS: 0%CPEs: 3EXPL: 1CVE-2023-40029 – Cluster secret might leak in cluster details page in Argo CD
https://notcve.org/view.php?id=CVE-2023-40029
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. pull request #7139 introduced the ability to manage cluster labels and annotations. Since clusters are stored as secrets it also exposes the `kubectl.kubernetes.io/last-applied-configuration` annotation which includes full secret body. In order to view the cluster annotations via the Argo CD API, the user must have `clusters, get` RBAC access. • https://github.com/argoproj/argo-cd/commit/4b2e5b06bff2ffd8ed1970654ddd8e55fc4a41c4 https://github.com/argoproj/argo-cd/pull/7139 https://github.com/argoproj/argo-cd/security/advisories/GHSA-fwr2-64vr-xv9m https://access.redhat.com/security/cve/CVE-2023-40029 https://bugzilla.redhat.com/show_bug.cgi?id=2233203 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2023-25163 – Argo CD leaks repository credentials in user-facing error messages and in logs
https://notcve.org/view.php?id=CVE-2023-25163
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error message is visible when a user attempts to create or update an Application via the Argo CD API (and therefor the UI or CLI). The user must have `applications, create` or `applications, update` RBAC access to reach the code which may produce the error. • https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac https://github.com/argoproj/argo-cd/issues/12309 https://github.com/argoproj/argo-cd/pull/12320 https://github.com/argoproj/argo-cd/security/advisories/GHSA-mv6w-j4xc-qpfw • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2021-23135 – Argo CD leaked secret data into error messages and logs on invalid edits via UI
https://notcve.org/view.php?id=CVE-2021-23135
Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14. Una exposición de los Datos del Sistema en una vulnerabilidad de Esfera de Control No Autorizada en la Interfaz de Usuario web de Argo CD permite a un atacante causar una filtración de datos secretos en unos registros y mensajes de error de la Interfaz de Usuario web. Este problema afecta a Argo CD versiones 1.8 anteriores a 1.8.7; versiones 1.7 anteriores a 1.7.14 • https://github.com/argoproj/argo-cd/security/advisories/GHSA-fp89-h8pj-8894 • CWE-209: Generation of Error Message Containing Sensitive Information CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-23347 – Cross-site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-23347
The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user. El paquete github.com/argoproj/argo-cd/cmd versiones anteriores a 1.7.13, versiones desde 1.8.0 y anteriores a 1.8.6, son vulnerables a un ataque de tipo Cross-site Scripting (XSS), el proveedor de SSO conectado a Argo CD tendría que devolver un mensaje de error malicioso que contiene JavaScript para el usuario • https://github.com/argoproj/argo-cd/pull/5563 https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDCMD-1078291 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •