GitHub Advisoryadvisory · Go

GHSA-vj54-cjrx-x696 Observable Discrepancy in Argo

MEDIUM Published 2021-12-09 Modified 2023-09-29 Official page ↗
Aliases
CVE-2020-11576
Ecosystem
Go
Packages
github.com/argoproj/argo-cd
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-203
Reviewed
2021-05-25

Affected packages

• Go github.com/argoproj/argo-cd: >= 1.5.0, < 1.5.1 → fixed in 1.5.1

Description

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise. Specific Go Packages Affected github.com/argoproj/argo-cd/util/session github.com/argoproj/argo-cd/server/session

Related

Alias · CVE (1)

  • CVE-2020-11576 Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames… vulnerability

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References