CVE-2024-37152: Unauthenticated Access to sensitive settings in Argo CD
Summary The CVE allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication.
Details Unauthenticated Access:
Endpoint: /api/v1/settings Description: This endpoint is accessible without any form of authentication as expected. All sensitive settings are hidden except passwordPattern.
Patches A patch for this vulnerability has been released in the following Argo CD versions:
v2.11.3 v2.10.12 v2.9.17
Impact Unauthenticated Access:
Type: Unauthorized Information Disclosure. Affected Parties: All users and administrators of the Argo CD instance. Potential Risks: Exposure of sensitive configuration data, including but not limited to deployment settings, security configurations, and internal network information.
Other sources
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37152?
CVE-2024-37152 has a high severity due to unauthorized access to sensitive settings.
How do I fix CVE-2024-37152?
To fix CVE-2024-37152, update to Argo CD version 2.11.3 or later, 2.10.12 or later, or 2.9.17 or later.
Which versions of Argo CD are affected by CVE-2024-37152?
CVE-2024-37152 affects Argo CD versions 2.11.0 to 2.11.3, 2.10.0 to 2.10.12, and 2.9.3 to 2.9.17.
What kind of access is granted by CVE-2024-37152?
CVE-2024-37152 allows unauthenticated access to the /api/v1/settings endpoint.
What data is at risk with CVE-2024-37152?
CVE-2024-37152 exposes sensitive settings, which could lead to unauthorized configuration changes.