{"id":"CVE-2024-41666","published":"2024-07-24T17:16:37Z","modified":"2024-08-12T21:02:57Z","title":"The Argo CD web terminal session does not handle the revocation of user permissions properly.","vendor":"argoproj","product":"argo-cd","tier":"tail","description":{"text":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to the user `p, role:myrole, exec, create, */*, allow`, even if the user revokes this permission, the user can still perform operations in the container, as long as the user keeps the terminal view open for a long time. Although the token expiration and revocation of the user are fixed, however, the fix does not address the situation of revocation of only user `p, role:myrole, exec, create, */*, allow` permissions, which may still lead to the leakage of sensitive information. A patch for this vulnerability has been released in Argo CD versions 2.11.7, 2.10.16, and 2.9.21.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.7,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00685,"percentile":0.52599,"provenance":"source"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-v8wx-v5jq-qhhw","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/argoproj/argo-cd/commit/05edb2a9ca48f0f10608c1b49fbb0cf7164f6476","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-cd/commit/e96f32d233504101ddac028a5bf8117433d333d6","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-cd/commit/ef535230d8bd8ad7b18aab1ea1063e9751d348c4","tags":["x_refsource_MISC"]},{"url":"https://drive.google.com/file/d/1Fynj5Sho8Lf8CETqsNXZyPKlTDdmgJuN/view?usp=sharing","tags":["x_refsource_MISC"]}],"priority":{"score":13.8,"factors":[{"name":"EPSS percentile","points":10.52},{"name":"CVSS severity","points":3.29}]},"vendorSlug":"argoproj","affectedVersions":[{"vendor":"argoproj","product":"argo-cd","versions":[">= 2.6.0, < 2.9.21",">= 2.10.0, < 2.10.16",">= 2.11.0, < 2.11.7"]}],"affected":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","vulnerableRanges":[">=2.6.0, <2.9.21",">=2.10.0, <2.10.16",">=2.11.0, <2.11.7"],"patched":["2.9.21","2.10.16","2.11.7"],"from":["GHSA-v8wx-v5jq-qhhw","GO-2024-3006"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-3006"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2418","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-argoproj-argo-cd-cve-2020-11576","parents":[{"from":"CVE-2023-40025","to":"CVE-2024-41666","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/application/terminal.go","server/application/websocket.go"],"commits":["https://github.com/argoproj/argo-cd/commit/e047efa8f9518c54d00d2e4493b64bc4dba98478","https://github.com/argoproj/argo-cd/commit/05edb2a9ca48f0f10608c1b49fbb0cf7164f6476","https://github.com/argoproj/argo-cd/commit/e96f32d233504101ddac028a5bf8117433d333d6"],"basis":"shared function","functions":["ServeHTTP"]}]},{"from":"CVE-2024-21661","to":"CVE-2024-41666","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/application/terminal.go","server/application/websocket.go"],"commits":["https://github.com/argoproj/argo-cd/commit/2a22e19e06aaf6a1e734443043310a66c234e345","https://github.com/argoproj/argo-cd/commit/5bbb51ab423f273dda74ab956469843d2db2e208","https://github.com/argoproj/argo-cd/commit/05edb2a9ca48f0f10608c1b49fbb0cf7164f6476","https://github.com/argoproj/argo-cd/commit/e96f32d233504101ddac028a5bf8117433d333d6"],"basis":"shared function","functions":["getToken"]}]}],"packageHistory":[{"cve":"CVE-2024-36106","published":"2024-06-06","fixed":"2.11.3","kev":false},{"cve":"CVE-2024-37152","published":"2024-06-06","fixed":"2.11.3","kev":false},{"cve":"CVE-2024-40634","published":"2024-07-22","fixed":"2.11.6","kev":false,"link":{"from":"CVE-2024-40634","to":"CVE-2024-41666","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v2","fromFixed":"2.9.20","toFixed":"2.9.21","daysApart":2}]}},{"cve":"CVE-2024-41666","published":"2024-07-24","fixed":"2.11.7","kev":false},{"cve":"CVE-2025-23216","published":"2025-01-30","fixed":"2.13.4","kev":false,"link":{"from":"CVE-2024-41666","to":"CVE-2025-23216","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v2","fromFixed":"2.11.7","toFixed":"2.11.13","daysApart":190}]}},{"cve":"CVE-2025-47933","published":"2025-05-29","fixed":"2.14.13","kev":false},{"cve":"CVE-2025-55190","published":"2025-09-04","fixed":"2.14.16","kev":false}],"package":"Go:github.com/argoproj/argo-cd/v2"}}