CVE-2024-21662

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Mar 18, 2024
CWE ID 307

Summary

CVE-2024-21662 is a vulnerability affecting Argo CD, a Kubernetes continuous delivery tool. Versions 2.8.13, 2.9.9, and 2.10.4 are susceptible to this flaw, which allows an attacker to bypass rate limits and brute force protection by exploiting the weak cache-based mechanism used by the application. This vulnerability can be combined with other weaknesses to target the default admin account, undermining a previous patch designed to protect against brute force attacks (CVE-2020-8827). The brute force protection in Argo CD relies on a cache that has a limit of 1000 entries, and an attacker can overflow this cache by bombarding it with login attempts for different users. As a result, the admin account's failed attempts are pushed out, resetting the rate limit for that account. This vulnerability poses a significant danger as it enables attackers to perform accelerated brute force attacks, specifically targeting the default admin account.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-21662 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options