Vulnerability Details : CVE-2021-23135
Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs. This issue affects Argo CD 1.8 versions prior to 1.8.7; 1.7 versions prior to 1.7.14.
Products affected by CVE-2021-23135
- cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
- cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-23135
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 10 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-23135
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:P/I:N/A:N |
3.9
|
2.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
1.8
|
3.6
|
NIST | |
|
5.9
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N |
1.5
|
4.0
|
Palo Alto Networks, Inc. |
CWE ids for CVE-2021-23135
-
The product generates an error message that includes sensitive information about its environment, users, or associated data.Assigned by: nvd@nist.gov (Primary)
-
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.Assigned by: psirt@paloaltonetworks.com (Secondary)
References for CVE-2021-23135
-
https://github.com/argoproj/argo-cd/security/advisories/GHSA-fp89-h8pj-8894
Argo CD leaked secret data into error messages and logs on invalid edits via UI · Advisory · argoproj/argo-cd · GitHubThird Party Advisory
Jump to