Veracode Vulnerability DatabaseVERACODE:47160Missing Default Authentication
9 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
7.1 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
13.1%
Argo CD is vulnerable to Missing Default Authentication. The vulnerability is due to the default lack of password protection in redis, allowing attackers with access to an unprivileged pod to connect to the Redis server to gain read/write access, modify the “mfst” (manifest) key to execute deployments via ArgoCD, and edit the “app|resources-tree” key to cause information leaks, as the cache values are neither signed nor validated.
References
github.com/advisories/GHSA-9766-5277-j5hr
github.com/argoproj/argo-cd/commit/2de0ceade243039c120c28374016c04ff9590d1d
github.com/argoproj/argo-cd/commit/35a7d6c7fa1534aceba763d6a68697f36c12e678
github.com/argoproj/argo-cd/commit/4e2fe302c3352a0012ecbe7f03476b0e07f7fc6c
github.com/argoproj/argo-cd/commit/53570cbd143bced49d4376d6e31bd9c7bd2659ff
github.com/argoproj/argo-cd/commit/6ef7b62a0f67e74b4aac2aee31c98ae49dd95d12
github.com/argoproj/argo-cd/commit/9552034a80070a93a161bfa330359585f3b85f07
github.com/argoproj/argo-cd/commit/bdd889d43969ba738ddd15e1f674d27964048994
github.com/argoproj/argo-cd/commit/f1a449e83ee73f8f14d441563b6a31b504f8d8b0
github.com/argoproj/argo-cd/security/advisories/GHSA-9766-5277-j5hr
Related
9 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
7.1 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
13.1%