high7.5
CVE-2020-8826
As of v1.5.0, the Argo web interface authentication system issued immutable tokens.
Impact
As of v1.5.0, the Argo web interface authentication system issued immutable tokens. Authentication tokens, once issued, were usable forever without expiration—there was no refresh or forced re-authentication.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Argoproj | Argo Cd | through 1.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://argoproj.github.io/argo-cd/security_considerations/
- https://github.com/argoproj/argo/releases
- https://www.soluble.ai/blog/argo-cves-2020
- https://argoproj.github.io/argo-cd/security_considerations/
- https://github.com/argoproj/argo/releases
- https://www.soluble.ai/blog/argo-cves-2020