{"id":"CVE-2018-21034","published":"2020-04-09T16:18:37Z","modified":"2024-08-05T12:19:27Z","title":"In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01374,"percentile":0.71986,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/argoproj/argo-cd/blob/a1afe44066fcd0a0ab90a02a23177164bbad42cf/util/diff/diff.go#L399","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-cd/issues/470","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-cd/pull/3088","tags":["x_refsource_MISC"]},{"url":"https://www.soluble.ai/blog/argo-cves-2020","tags":["x_refsource_MISC"]}],"priority":{"score":14.4,"factors":[{"name":"EPSS percentile","points":14.4}]},"affected":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","vulnerableRanges":["<1.5.0-rc1"],"patched":["1.5.0-rc1"],"from":["GHSA-xj7v-c82w-92q2","GO-2023-1952"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5808","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-argoproj-argo-cd-cve-2020-11576","children":[{"from":"CVE-2018-21034","to":"CVE-2022-41354","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/application/application.go"],"commits":["https://github.com/argoproj/argo-cd/commit/916d4aed5775fead4ab75f47c1d352cd0e73b815","https://github.com/argoproj/argo-cd/commit/3a28c8a18cc2aa84fe81492625545d25c7a90bc3"],"basis":"shared function","functions":["GetManifests"]}]},{"from":"CVE-2018-21034","to":"CVE-2024-31990","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/application/application.go"],"commits":["https://github.com/argoproj/argo-cd/commit/916d4aed5775fead4ab75f47c1d352cd0e73b815","https://github.com/argoproj/argo-cd/commit/c514105af739eebedb9dbe89d8a6dd8dfc30bb2c","https://github.com/argoproj/argo-cd/commit/c5a252c4cc260e240e2074794aedb861d07e9ca5"],"basis":"shared function","functions":["GetManifests"]}]}],"packageHistory":[{"cve":"CVE-2018-21034","published":"2020-04-09","fixed":"1.5.0-rc1","kev":false},{"cve":"CVE-2020-11576","published":"2020-04-08","fixed":"1.5.1","kev":false},{"cve":"CVE-2020-8827","published":"2020-04-08","fixed":"1.5.1","kev":false,"link":{"from":"CVE-2018-21034","to":"CVE-2020-8827","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd","fromFixed":"1.5.0-rc1","toFixed":"1.5.1","daysApart":-1}]}},{"cve":"CVE-2021-23347","published":"2021-03-03","fixed":"1.8.6","kev":false}],"package":"Go:github.com/argoproj/argo-cd"}}