CVE-2019-12494 Missing authorization in n/a

High 8.5 Published 5 Jun 2019 Updated 4 Aug 2024

Attackers can access data from other clusters by sending HTTP requests through the VPN endpoint due to missing access controls in Gardener.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-12494?

CVE-2019-12494 is a high-severity missing authorization vulnerability in n/a, published on 5 Jun 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Gardener before 0.20.0, incorrect access control in seed clusters allows information disclosure by sending HTTP GET requests from one's own shoot clusters to foreign shoot clusters. This occurs because traffic from shoot to seed via the VPN endpoint is not blocked.

Which versions are affected by CVE-2019-12494?

It affects 1 product.

Products include Gardener Gardener.

How do I fix CVE-2019-12494?

No fix has been published for CVE-2019-12494 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-12494 being exploited?

There is no known exploitation of CVE-2019-12494 in the wild and no public exploit code.

Sources

Also known as GHSA-9j69-f6q8-h6wm.