CVE-2024-21652: Bypassing Brute Force Protection via Application Crash and In-Memory Data Loss
(updated )
An attacker can exploit a chain of vulnerabilities, including a Denial of Service (DoS) flaw and in-memory data storage weakness, to effectively bypass the application’s brute force login protection. This makes the application susceptible to brute force attacks, compromising the security of all user accounts.
References
- argo-cd.readthedocs.io/en/stable/security_considerations/
- github.com/advisories/GHSA-x32m-mvfj-52xv
- github.com/argoproj/argo-cd
- github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d
- github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b
- github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456
- github.com/argoproj/argo-cd/security/advisories/GHSA-x32m-mvfj-52xv
- nvd.nist.gov/vuln/detail/CVE-2024-21652
Code Behaviors & Features
Detect and mitigate CVE-2024-21652 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →