Homepage
About Snyk

Brute Force Affecting github.com/argoproj/argo-cd/util/session package, versions *

Severity

 Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    EPSS
    0.05% (17th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDUTILSESSION-6457471
  • published 19 Mar 2024
  • disclosed 19 Mar 2024
  • credit Nadav Aharon-Nov
Report a new vulnerability Found a mistake?

Introduced: 19 Mar 2024

CVE-2024-21662 Open this link in a new tab
CWE-307 Open this link in a new tab

How to fix?

There is no fixed version for github.com/argoproj/argo-cd/util/session.

Overview

github.com/argoproj/argo-cd/util/session is a Declarative continuous deployment for Kubernetes.

Affected versions of this package are vulnerable to Brute Force by overflowing the login cache mechanism. An attacker can reset the defaultMaxCacheSize (including for the default admin account) by making many login attempts for different users, thus removing entries for previous failed attempts for the target account.

This is a bypass for the previously reported CVE-2020-8827.

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
6.5 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    High
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    High
  • Availability (A)
    None