-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/argoproj/argo-cd/v2/server | go | >= 2.9.3, < 2.9.17 | 2.9.17 |
| github.com/argoproj/argo-cd/v2/server | go | >= 2.10.0, < 2.10.12 | 2.10.12 |
| github.com/argoproj/argo-cd/v2/server | go | >= 2.11.0, < 2.11.3 | 2.11.3 |
Miggo AIRoot Cause AnalysisThe commit diff shows the PasswordPattern field was removed from the default response and gated behind a sessionmgr.LoggedIn(ctx) check. This indicates the Get() function in settings.go was previously returning this sensitive field without authentication. The vulnerability documentation explicitly calls out this endpoint as being accessible without authentication, and the patch specifically modifies this function to add authentication checks for the PasswordPattern field. The function's role in handling the /api/v1/settings endpoint and the direct correlation between the patch changes and vulnerability description provide high confidence in this assessment.
GoGoOngoing coverage of React2Shell