CVE-2020-9301

HIGH

Linuxfoundation Spinnaker < 1.21.5 - Insecure Deserialization

Title source: rule

Description

Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnerability exists within the handling of SpEL expressions that allows an attacker to read and write arbitrary files within the orca container via authenticated HTTP POST requests.

References (1)

[Patch, Third Party Advisory] https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-006.md

View Patch ZIP pw:eip

Scores

CVSS v3 8.8

EPSS 0.0081

EPSS Percentile 74.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502

Status published

Affected Products (1)

linuxfoundation/spinnaker < 1.21.5

Timeline

Published Dec 11, 2020

Tracked Since Feb 18, 2026