CVE-2019-12494

—

CVSS 3.0

7.5 high

EPSS

2%p78

Published

Jun 5, 2019 (Jun 5, 2019)

Modified

Jun 17, 2026

Description

In Gardener before 0.20.0, incorrect access control in seed clusters allows information disclosure by sending HTTP GET requests from one's own shoot clusters to foreign shoot clusters. This occurs because traffic from shoot to seed via the VPN endpoint is not blocked.

Vendors: gardener
Products: gardener
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.9%)

In the news0 stories

No ingested article mentions this CVE yet.