CVE-2020-9301

HIGH

Spinnaker < 1.21.5 - Authenticated Arbitrary File Read and Write via SpEL Expression Handling

Title source: llm
STIX 2.1

Description

Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnerability exists within the handling of SpEL expressions that allows an attacker to read and write arbitrary files within the orca container via authenticated HTTP POST requests.

References (1)

Core 1

Scores

CVSS v3 8.8
EPSS 0.0150
EPSS Percentile 71.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (1)
linuxfoundation/spinnaker < 1.21.5
Published Dec 11, 2020
Tracked Since Feb 18, 2026