{"id":"CVE-2020-11576","published":"2020-04-08T17:40:50Z","modified":"2024-08-04T11:35:13Z","title":"Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to…","vendor":null,"product":null,"tier":"tail","description":{"text":"Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01973,"percentile":0.80411,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/argoproj/argo-cd/pull/3215","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-cd/commit/35a7350b7444bcaf53ee0bb11b9d8e3ae4b717a1","tags":["x_refsource_MISC"]},{"url":"https://www.soluble.ai/blog/argo-cves-2020","tags":["x_refsource_MISC"]}],"priority":{"score":16.1,"factors":[{"name":"EPSS percentile","points":16.08}]},"affected":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","vulnerableRanges":[">=1.5.0, <1.5.1"],"patched":["1.5.1"],"from":["GHSA-vj54-cjrx-x696","GO-2022-0882"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-2593","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-argoproj-argo-cd-cve-2020-11576","children":[{"from":"CVE-2020-11576","to":"CVE-2024-21661","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["util/session/sessionmanager.go"],"commits":["https://github.com/argoproj/argo-cd/commit/35a7350b7444bcaf53ee0bb11b9d8e3ae4b717a1","https://github.com/argoproj/argo-cd/commit/2a22e19e06aaf6a1e734443043310a66c234e345","https://github.com/argoproj/argo-cd/commit/5bbb51ab423f273dda74ab956469843d2db2e208"],"basis":"shared function","functions":["Parse"]}]}]}}