Argo CD web terminal session doesn't expire
CVE-2023-40025

4.7MEDIUM

Key Information:

Vendor

Argoproj

Status
Argo-cd
Vendor
CVE Published:
23 August 2023
đź”” Create Argoproj Vulnerability Alert

What is CVE-2023-40025?

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug where open web terminal sessions do not expire. This bug allows users to send any websocket messages even if the token has already expired. The most straightforward scenario is when a user opens the terminal view and leaves it open for an extended period. This allows the user to view sensitive information even when they should have been logged out already. A patch for this vulnerability has been released in the following Argo CD versions: 2.6.14, 2.7.12 and 2.8.1.

Affected Version(s)

argo-cd >= 2.6.0, < 2.6.14 < 2.6.0, 2.6.14

argo-cd >= 2.7.0, < 2.7.12 < 2.7.0, 2.7.12

argo-cd = 2.8.0 = 2.8.0

References

https://github.com/argoproj/argo-cd/security/advisories/G...
x_refsource_CONFIRM
https://github.com/argoproj/argo-cd/commit/e047efa8f9518c...
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.