CVE-2024-37152: Unauthenticated Access to sensitive settings in Argo CD

June 6, 2024

The CVE allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication.

References

github.com/advisories/GHSA-87p9-x75h-p4j2
github.com/argoproj/argo-cd
github.com/argoproj/argo-cd/commit/256d90178b11b04bc8174d08d7b663a2a7b1771b
github.com/argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2
nvd.nist.gov/vuln/detail/CVE-2024-37152

Code Behaviors & Features

Detect and mitigate CVE-2024-37152 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →