CVE-2020-11576: Observable Discrepancy

December 9, 2021 (updated September 29, 2023)

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise.

References

github.com/advisories/GHSA-vj54-cjrx-x696
github.com/argoproj/argo-cd/commit/35a7350b7444bcaf53ee0bb11b9d8e3ae4b717a1
github.com/argoproj/argo-cd/pull/3215
nvd.nist.gov/vuln/detail/CVE-2020-11576
www.soluble.ai/blog/argo-cves-2020

Code Behaviors & Features

Detect and mitigate CVE-2020-11576 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →