CVE-2021-23135: argo cd
CVSS: 5.9v3.1MediumModified
Published 12-05-2021Last modified 16-09-2024
Vulnerability summary
CVE-2021-23135 is a medium (CVSS 5.9) vulnerability in argo cd. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.1% of scored vulnerabilities.
CVSS score
5.9/10
010
Medium · v3.1 (CVE.org)EPSS score
0.23%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 12-05-2021PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 5.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:NSources2 sources · 5.5–5.9
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
Low 2.1Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
0.23%
Chance of exploitation in the next 30 days
Percentile
13%
Versus all other CVEs
30-day change
0.00 pp
From 0.23% on 19-09-2026
19-09-202619-10-2026
EPSS score0.23%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-497Exposure of Sensitive System Information to an Unauthorized Control SphereThe product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
- CWE-209Generation of Error Message Containing Sensitive InformationThe product generates an error message that includes sensitive information about its environment, users, or associated data.
Affected systems
Argo cd1 product
- argo cd≥ 1.8, < 1.8.7 | ≥ 1.7, < 1.7.14
Argoproj1 product
- argo_cd≥ 1.7.0, < 1.7.14 | ≥ 1.8.0, < 1.8.7
2 vendors · 2 products
References
1 links- github.com/argoproj/argo-cd/security/advisories/GHSA-fp89-h8pj-8894X Refsource MISCThird Party Advisory