Issue 172: Argo CD vulnerability, state of API security survey, API testing with Zap and Postman
Brief
This week, we have news of a vulnerability in Argo CD that allowed leaking application secrets, a survey of the state of API security across three regions, a quick read on how to use Postman and OWASP Zap for API security testing, and finally views on how to distribute authorization services in a microservice architecture.
Vulnerability: Argo CD path-traversal vulnerability enables leaking data
This week’s major news has been the vulnerability discovered in Argo CD , a popular continuous delivery platform.
The vulnerability (CVE-2022-24348, CVSS score of 7. 7) was discovered by researchers at Apiiro, and allowed attackers to exploit a path traversal vulnerability in the platform to gain access to other application instances. Researchers believe this could have led to leaking passwords, API keys, and tokens.