Information disclosure in Argo CD - CVE-2023-25163
Published: February 8, 2023
Vulnerability identifier: #VU72074
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-25163
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The
error message is visible when a user attempts to create or update an
Application via the Argo CD API (and therefor the UI or CLI). The user
must have applications, create or applications, update RBAC access to reach the code which may produce the error. A remote user can gain unauthorized access to sensitive information.
Affected software
Argo CD
How to mitigate CVE-2023-25163
Install updates from vendor's website.
Argo CD - update to 2.6.1