CVE-2018-21034: 
Argo CD vulnerability analysis and mitigation

In Argo versions prior to v1.5.0-rc1, authenticated Argo users could submit API calls to retrieve secrets and other manifests stored within git. This vulnerability was assigned CVE-2018-21034 and was disclosed in April 2020. The vulnerability affects Argo CD, a declarative continuous deployment framework for Kubernetes (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, and a CVSS v2.0 Base Score of 4.0 (MEDIUM). The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The issue allowed authenticated users to access sensitive information through API calls that should have been restricted (NVD).

The vulnerability could lead to unauthorized access to secrets and other sensitive manifests stored in git repositories managed by Argo CD. This exposure of sensitive information could potentially compromise the security of the Kubernetes clusters and applications managed through Argo CD (NVD).

The vulnerability was fixed in Argo CD version v1.5.0-rc1. Users should upgrade to this version or later to protect against this security issue. The fix involves implementing proper access controls for API calls that retrieve sensitive information from git repositories (GitHub PR).