| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/argoproj/argo-cd | all versions | |
| github.com/argoproj/argo-cd/v2 | ≥ 2.10.0, < 2.10.12≥ 2.11.0, < 2.11.3≥ 2.9.3, < 2.9.17 | 2.10.122.11.32.9.17 |
| github.com/argoproj/argo-cd/v2/server | ≥ 2.10.0, < 2.10.12≥ 2.11.0, < 2.11.3≥ 2.9.3, < 2.9.17 | 2.10.122.11.32.9.17 |
| argo cd | ≥ 2.10.0, < 2.10.12≥ 2.11.0, < 2.11.3≥ 2.9.3, < 2.9.17 | 2.10.122.11.32.9.17 |
The CVE allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication.
Description: This endpoint is accessible without any form of authentication as expected. All sensitive settings are hidden except passwordPattern.
Patches A patch for this vulnerability has been released in the following Argo CD versions:
v2.11.3 v2.10.12 v2.9.17
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free