Lucene search

[email protected]NVD:CVE-2019-12494

HistoryJun 05, 2019 - 7:29 p.m.

CVE-2019-12494

2019-06-0519:29:00

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

8.1

Confidence

High

EPSS

0.002

Percentile

51.6%

JSON

In Gardener before 0.20.0, incorrect access control in seed clusters allows information disclosure by sending HTTP GET requests from one’s own shoot clusters to foreign shoot clusters. This occurs because traffic from shoot to seed via the VPN endpoint is not blocked.

Affected configurations

Nvd

Node

gardenergardenerRange<0.20.0

VendorProductVersionCPE
gardenergardener*cpe:2.3:a:gardener:gardener:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gardener	gardener	*	cpe:2.3:a:gardener:gardener::::::::

References

github.com/gardener/gardener/pull/874

github.com/gardener/vpn/issues/40

groups.google.com/forum/#%21topic/gardener/pH6dNIEhv-A

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

8.1

Confidence

High

EPSS

0.002

Percentile

51.6%

JSON

Related for NVD:CVE-2019-12494

veracode1 prion1 osv1 cve1 cvelist1