CVE-2019-12494

In Gardener before 0.20.0, incorrect access control in seed clusters allows information disclosure by sending HTTP GET requests from one's own shoot clusters…

High · published June 5, 2019

CVSS v3.0
8.5
EPSS
2%
Percentile
79.4
In the wild
Unconfirmed
What it is

In Gardener before 0.20.0, incorrect access control in seed clusters allows information disclosure by sending HTTP GET requests from one's own shoot clusters to foreign shoot clusters. This occurs because traffic from shoot to seed via the VPN endpoint is not blocked.

The record
Technical detail
CVSS v3.0
8.5 · HIGH
Vector
CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
CVSS v4.0
Not supplied
EPSS
0.01894 · 79.4th percentile
Published
2019-06-05T18:44Z
EPSS history
Timeline
  • 05 JUN 18:44Z
    In Gardener before 0.20.0, incorrect access control in seed clusters allows information disclosure by sending HTTP GET requests from one's own shoot clusters…
    cvelistv5