CVE-2020-11576

2020-04-0818:15:15

Google

osv.dev

6.6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

41.5%

JSON

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise.

CPENameOperatorVersion
argo-cdeq0.3.2
argo-cdeq0.7.0
argo-cdeq0.1.0
argo-cdeq0.4.3
argo-cdeq0.4.0-alpha1
argo-cdeq0.5.0
argo-cdeq0.2.0
argo-cdeq1.5.0-rc1
argo-cdeq0.5.1
argo-cdeq0.8.0

Name	Operator	Version
argo-cd	eq	0.3.2
argo-cd	eq	0.7.0
argo-cd	eq	0.1.0
argo-cd	eq	0.4.3
argo-cd	eq	0.4.0-alpha1
argo-cd	eq	0.5.0
argo-cd	eq	0.2.0
argo-cd	eq	1.5.0-rc1
argo-cd	eq	0.5.1
argo-cd	eq	0.8.0