Description

The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure.

Remediation

References

https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-003.md

Related Vulnerabilities

CVE-2022-34870 Vulnerability in maven package org.apache.geode:geode-pulse

CVE-2021-23411 Vulnerability in npm package anchorme

CVE-2021-41183 Vulnerability in maven package org.webjars.bower:jquery-ui

CVE-2020-35490 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2021-23369 Vulnerability in npm package handlebars

Severity

High

Classification

CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Patch Third Party Advisory