Lack of protection against brute force attacks In github.com/argoproj/argo-cd/util/cache
Description
Improper Restriction of Excessive Authentication Attempts in Argo API As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.
Specific Go Packages Affected
github.com/argoproj/argo-cd/util/cache
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 go | 1.5.1 | ||
go | 1.5.1 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3. 4. 5. 6. 7. 8.