High severity · published Dec 11, 2020
CVE-2020-9301
Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5
8.8
CVSS
1.5%
EPSS
No
On KEV
Description
Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnerability exists within the handling of SpEL expressions that allows an attacker to read and write arbitrary files within the orca container via authenticated HTTP POST requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Spinnaker · Linuxfoundation
before 1.21.5; 1.22.0 before 1.22.4; 1.23.0 before 1.23.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9301
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9301
Patch
https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-006.md
More from Spinnaker
9.9
CVE-2026-32613
Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling
9.9
CVE-2026-32604
Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
9.8
CVE-2021-43832
Spinnaker is an open source, multi-cloud continuous delivery platform
8.8
CVE-2026-44795
Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types
7.5
CVE-2026-55175
Spinnaker: Improper yaml processing on kustomize bake operations