CVE-2020-8827 Information

Description

As of v1.5.0 the Argo API does not implement anti-automation measures such as rate limiting account lockouts or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Reference

https://argoproj.github.io/argo-cd/operator-manual/user-management/disable-admin-user https://argoproj.github.io/argo-cd/security_considerations/ https://github.com/argoproj/argo/releases https://www.soluble.ai/blog/argo-cves-2020

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

NONE

Base Severity

7.5