{"id":"GHSA-4fcw-pq4r-f4q7","summary":"Server-Side Request Forgery in Spinnaker Orca","details":"The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure.","aliases":["CVE-2020-9298"],"modified":"2023-11-01T04:53:49.018259Z","published":"2021-05-07T15:54:31Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2021-05-05T19:53:13Z","nvd_published_at":"2020-08-28T15:15:00Z","cwe_ids":["CWE-918"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9298"},{"type":"WEB","url":"https://github.com/spinnaker/orca/pull/3706/commits/4f3c07da8fcacd67bb1984aef11b2066f2c0d11c"},{"type":"WEB","url":"https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-003.md"},{"type":"WEB","url":"https://github.com/spinnaker/orca/releases/tag/v8.7.0"}],"affected":[{"package":{"name":"com.netflix.spinnaker.orca:orca-core","ecosystem":"Maven","purl":"pkg:maven/com.netflix.spinnaker.orca/orca-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-4fcw-pq4r-f4q7/GHSA-4fcw-pq4r-f4q7.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}