CVE-2024-36106 MEDIUM

CVE-2024-36106: Argo CD allows authenticated users to enumerate clusters by name

Vendor Argoproj
Product argo-cd
Weakness CWE-209 · Error message info leak
Published June 6, 2024
Last update September 3, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

Key dates

02Disclosure timeline

June 6, 2024 CVE published
September 3, 2024 Record updated