CVE-2024-36106CWE-209

Argo CD allows authenticated users to enumerate clusters by name

Medium · published June 6, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
33.9
In the wild
Unconfirmed
What it is

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00408 · 33.9th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2024-06-06T15:09Z
EPSS history
Timeline
  • 06 JUN 15:09Z
    Argo CD allows authenticated users to enumerate clusters by name
    cvelistv5