Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-37152

CVE-2024-37152: Unauthenticated Access to sensitive settings in Argo CD

5.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-37152
GHSA ID
GHSA-87p9-x75h-p4j2
EPSS Score
0.95336%
CWE
CWE-22
Published
6/6/2024
Updated
6/17/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/argoproj/argo-cd/v2/servergo>= 2.9.3, < 2.9.172.9.17
github.com/argoproj/argo-cd/v2/servergo>= 2.10.0, < 2.10.122.10.12
github.com/argoproj/argo-cd/v2/servergo>= 2.11.0, < 2.11.32.11.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The commit diff shows the PasswordPattern field was removed from the default response and gated behind a sessionmgr.LoggedIn(ctx) check. This indicates the Get() function in settings.go was previously returning this sensitive field without authentication. The vulnerability documentation explicitly calls out this endpoint as being accessible without authentication, and the patch specifically modifies this function to add authentication checks for the PasswordPattern field. The function's role in handling the /api/v1/settings endpoint and the direct correlation between the patch changes and vulnerability description provide high confidence in this assessment.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

# Summ*ry T** *V* *llows un*ut*oriz** ****ss to t** s*nsitiv* s*ttin*s *xpos** *y /*pi/v*/s*ttin*s *n*point wit*out *ut**nti**tion. # **t*ils ## **Un*ut**nti**t** ****ss:** ### *n*point: /*pi/v*/s*ttin*s **s*ription: T*is *n*point is ****ssi*l* w

Reasoning

T** *ommit *i** s*ows t** P*sswor*P*tt*rn *i*l* w*s r*mov** *rom t** ****ult r*spons* *n* **t** ***in* * `s*ssionm*r.Lo****In(*tx)` ****k. T*is in*i**t*s t** `**t()` *un*tion in `s*ttin*s.*o` w*s pr*viously r*turnin* t*is s*nsitiv* *i*l* wit*out *ut*