CVE-2020-8827: Improper Restriction of Excessive Authentication Attempts
(updated )
As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.
References
- argoproj.github.io/argo-cd/operator-manual/user-management/
- argoproj.github.io/argo-cd/security_considerations/
- github.com/advisories/GHSA-xcqr-9h24-vrgw
- github.com/argoproj/argo-cd/commit/35a7350b7444bcaf53ee0bb11b9d8e3ae4b717a1
- github.com/argoproj/argo-cd/pull/3369
- github.com/argoproj/argo-cd/pull/3404
- github.com/argoproj/argo/releases
- nvd.nist.gov/vuln/detail/CVE-2020-8827
- www.soluble.ai/blog/argo-cves-2020
Code Behaviors & Features
Detect and mitigate CVE-2020-8827 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →