Insufficient Session Expiration Affecting github.com/argoproj/argo-cd/v2/server/application package, versions >=2.6.0 <2.9.21 >=2.10.0 <2.10.16 >=2.11.0 <2.11.7
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.05% (17th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDV2SERVERAPPLICATION-7558560
- published 25 Jul 2024
- disclosed 24 Jul 2024
- credit ClownandBox
Introduced: 24 Jul 2024
CVE-2024-41666 Open this link in a new tabHow to fix?
Upgrade github.com/argoproj/argo-cd/v2/server/application to version 2.9.21, 2.10.16, 2.11.7 or higher.
Overview
github.com/argoproj/argo-cd/v2/server/application is a declarative, GitOps continuous delivery tool for Kubernetes.
Affected versions of this package are vulnerable to Insufficient Session Expiration in the web-based terminal. A user with p, role:myrole, exec, create, */*, allow permission, whose permission has been revoked by an administrator, can continue accessing the container with that permission as long as their existing session is kept open.