Vulnerability Details CVE-2020-8828
As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 64.8%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.5
References
Products affected by CVE-2020-8828
-
cpe:2.3:a:argoproj:argo_cd:-
-
cpe:2.3:a:argoproj:argo_cd:0.1.0
-
cpe:2.3:a:argoproj:argo_cd:0.10.0
-
cpe:2.3:a:argoproj:argo_cd:0.10.1
-
cpe:2.3:a:argoproj:argo_cd:0.10.2
-
cpe:2.3:a:argoproj:argo_cd:0.10.3
-
cpe:2.3:a:argoproj:argo_cd:0.10.4
-
cpe:2.3:a:argoproj:argo_cd:0.10.5
-
cpe:2.3:a:argoproj:argo_cd:0.10.6
-
cpe:2.3:a:argoproj:argo_cd:0.11.0
-
cpe:2.3:a:argoproj:argo_cd:0.11.1
-
cpe:2.3:a:argoproj:argo_cd:0.11.2
-
cpe:2.3:a:argoproj:argo_cd:0.12.0
-
cpe:2.3:a:argoproj:argo_cd:0.12.1
-
cpe:2.3:a:argoproj:argo_cd:0.12.2
-
cpe:2.3:a:argoproj:argo_cd:0.12.3
-
cpe:2.3:a:argoproj:argo_cd:0.2.0
-
cpe:2.3:a:argoproj:argo_cd:0.3.0
-
cpe:2.3:a:argoproj:argo_cd:0.3.1
-
cpe:2.3:a:argoproj:argo_cd:0.3.2
-
cpe:2.3:a:argoproj:argo_cd:0.3.3
-
cpe:2.3:a:argoproj:argo_cd:0.4.0
-
cpe:2.3:a:argoproj:argo_cd:0.4.1
-
cpe:2.3:a:argoproj:argo_cd:0.4.2
-
cpe:2.3:a:argoproj:argo_cd:0.4.3
-
cpe:2.3:a:argoproj:argo_cd:0.4.4
-
cpe:2.3:a:argoproj:argo_cd:0.4.5
-
cpe:2.3:a:argoproj:argo_cd:0.4.6
-
cpe:2.3:a:argoproj:argo_cd:0.4.7
-
cpe:2.3:a:argoproj:argo_cd:0.5.0
-
cpe:2.3:a:argoproj:argo_cd:0.5.1
-
cpe:2.3:a:argoproj:argo_cd:0.5.2
-
cpe:2.3:a:argoproj:argo_cd:0.5.3
-
cpe:2.3:a:argoproj:argo_cd:0.5.4
-
cpe:2.3:a:argoproj:argo_cd:0.6.0
-
cpe:2.3:a:argoproj:argo_cd:0.6.1
-
cpe:2.3:a:argoproj:argo_cd:0.6.2
-
cpe:2.3:a:argoproj:argo_cd:0.7.0
-
cpe:2.3:a:argoproj:argo_cd:0.7.1
-
cpe:2.3:a:argoproj:argo_cd:0.7.2
-
cpe:2.3:a:argoproj:argo_cd:0.8.0
-
cpe:2.3:a:argoproj:argo_cd:0.8.1
-
cpe:2.3:a:argoproj:argo_cd:0.8.2
-
cpe:2.3:a:argoproj:argo_cd:0.9.0
-
cpe:2.3:a:argoproj:argo_cd:0.9.1
-
cpe:2.3:a:argoproj:argo_cd:0.9.2
-
cpe:2.3:a:argoproj:argo_cd:1.0.0
-
cpe:2.3:a:argoproj:argo_cd:1.0.1
-
cpe:2.3:a:argoproj:argo_cd:1.0.2
-
cpe:2.3:a:argoproj:argo_cd:1.1.0
-
cpe:2.3:a:argoproj:argo_cd:1.1.1
-
cpe:2.3:a:argoproj:argo_cd:1.1.2
-
cpe:2.3:a:argoproj:argo_cd:1.2.0
-
cpe:2.3:a:argoproj:argo_cd:1.2.1
-
cpe:2.3:a:argoproj:argo_cd:1.2.2
-
cpe:2.3:a:argoproj:argo_cd:1.2.3
-
cpe:2.3:a:argoproj:argo_cd:1.2.4
-
cpe:2.3:a:argoproj:argo_cd:1.2.5
-
cpe:2.3:a:argoproj:argo_cd:1.3.0
-
cpe:2.3:a:argoproj:argo_cd:1.3.1
-
cpe:2.3:a:argoproj:argo_cd:1.3.2
-
cpe:2.3:a:argoproj:argo_cd:1.3.3
-
cpe:2.3:a:argoproj:argo_cd:1.3.4
-
cpe:2.3:a:argoproj:argo_cd:1.3.5
-
cpe:2.3:a:argoproj:argo_cd:1.3.6
-
cpe:2.3:a:argoproj:argo_cd:1.4.0
-
cpe:2.3:a:argoproj:argo_cd:1.4.1
-
cpe:2.3:a:argoproj:argo_cd:1.4.2
-
cpe:2.3:a:argoproj:argo_cd:1.4.3