CVE-2021-23135: Argo CD leaked secret data into error messages and logs on invalid edits via UI
Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-23135?
CVE-2021-23135 is a vulnerability in the web UI of Argo CD that allows an attacker to leak secret data into web UI error messages and logs.
What is the severity of CVE-2021-23135?
The severity of CVE-2021-23135 is medium, with a severity value of 5.5.
Which versions of Argo CD are affected by CVE-2021-23135?
Argo CD 1.8 versions prior to 1.8.7 and 1.7 versions prior to 1.7.14 are affected by CVE-2021-23135.
How can an attacker exploit CVE-2021-23135?
An attacker can exploit CVE-2021-23135 by causing leaked secret data into web UI error messages and logs.
How can I fix CVE-2021-23135?
To fix CVE-2021-23135, update Argo CD to version 1.8.7 for 1.8.x versions or version 1.7.14 for 1.7.x versions.