CVE-2022-24829 is a critical authentication bypass vulnerability affecting Garden, an automation platform for Kubernetes development and testing, in versions prior to 0.12.39. Unauthenticated endpoints, particularly the /api endpoint, leak configuration data, including credentials and secrets, when the Garden dashboard server is accessible on 0.0.0.0. This allows remote attackers to gain unauthorized access and potentially compromise the system. With a CVSS score of 9.8 (CRITICAL), this vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. The FAUCET Risk Score is 77/100, indicating significant risk. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, which is typical for a large percentage of CVEs. Users are strongly advised to upgrade to version 0.12.39 or implement firewall rules to block access to port 9777 from untrusted networks.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.12.39CPE matchmatch criteria | cpe:2.3:a:garden:garden:*:*:*:*:*:kubernetes:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.