{"id":"CVE-2020-8827","published":"2020-04-08T19:43:40Z","modified":"2024-08-04T10:12:10Z","title":"As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or…","vendor":null,"product":null,"tier":"tail","description":{"text":"As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02212,"percentile":0.82588,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/argoproj/argo/releases","tags":["x_refsource_MISC"]},{"url":"https://www.soluble.ai/blog/argo-cves-2020","tags":["x_refsource_MISC"]},{"url":"https://argoproj.github.io/argo-cd/security_considerations/","tags":["x_refsource_MISC"]},{"url":"https://argoproj.github.io/argo-cd/operator-manual/user-management/#disable-admin-user","tags":["x_refsource_MISC"]}],"priority":{"score":16.5,"factors":[{"name":"EPSS percentile","points":16.52}]},"affected":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","vulnerableRanges":["<1.5.1"],"patched":["1.5.1"],"from":["GHSA-xcqr-9h24-vrgw","GO-2022-0892"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1501","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-argoproj-argo-cd-cve-2020-11576","children":[{"from":"CVE-2020-8827","to":"CVE-2024-21661","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["util/session/sessionmanager.go"],"commits":["https://github.com/argoproj/argo-cd/commit/35a7350b7444bcaf53ee0bb11b9d8e3ae4b717a1","https://github.com/argoproj/argo-cd/commit/2a22e19e06aaf6a1e734443043310a66c234e345","https://github.com/argoproj/argo-cd/commit/5bbb51ab423f273dda74ab956469843d2db2e208"],"basis":"shared function","functions":["Parse"]}]}],"packageHistory":[{"cve":"CVE-2018-21034","published":"2020-04-09","fixed":"1.5.0-rc1","kev":false,"link":{"from":"CVE-2018-21034","to":"CVE-2020-8827","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd","fromFixed":"1.5.0-rc1","toFixed":"1.5.1","daysApart":-1}]}},{"cve":"CVE-2020-11576","published":"2020-04-08","fixed":"1.5.1","kev":false},{"cve":"CVE-2020-8827","published":"2020-04-08","fixed":"1.5.1","kev":false},{"cve":"CVE-2021-23347","published":"2021-03-03","fixed":"1.8.6","kev":false,"link":{"from":"CVE-2020-8827","to":"CVE-2021-23347","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd","fromFixed":"1.5.1","toFixed":"1.7.13","daysApart":329}]}},{"cve":"CVE-2022-24348","published":"2022-02-04","fixed":"2.1.9","kev":false},{"cve":"CVE-2022-24905","published":"2022-05-20","fixed":"2.1.15","kev":false}],"package":"Go:github.com/argoproj/argo-cd"}}