CVE-2019-12494

Published: Jun 5, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Gardener before 0.20.0, incorrect access control in seed clusters allows information disclosure by sending HTTP GET requests from one's own shoot clusters to foreign shoot clusters. This occurs because traffic from shoot to seed via the VPN endpoint is not blocked.

Affected (1)

Products: Gardener: Gardener

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gardener Gardener	Before 0.20.0

References (6)

https://github.com/gardener/gardener/pull/874

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://github.com/gardener/vpn/issues/40

Source: cve@mitre.org

Third Party Advisory

https://groups.google.com/forum/#%21topic/gardener/pH6dNIEhv-A

Source: cve@mitre.org

https://github.com/gardener/gardener/pull/874

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://github.com/gardener/vpn/issues/40

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://groups.google.com/forum/#%21topic/gardener/pH6dNIEhv-A

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.