CVE-2024-41666

2024-07-2508:08:05

redhat.com

access.redhat.com

argo cd

kubernetes

unauthorized access

sensitive information

vulnerability

patched

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

AI Score

4.6

Confidence

High

EPSS

Percentile

16.1%

JSON

A vulnerability was found in ArgoCD’s web-based terminal. This issue may allow a user to continue sending WebSocket messages and access sensitive information even after their p, role:myrole, exec, create, /, and allow permissions are revoked. The terminal session remains active as long as it is kept open, enabling unauthorized operations within the container, allowing an attacker to maintain the terminal session to gain access and view sensitive data despite revoked permissions.