What is GHSA-4fcw-pq4r-f4q7?

GHSA-4fcw-pq4r-f4q7 is a security advisory published by GitHub Security Advisories with High severity. Server-Side Request Forgery in Spinnaker Orca

Which CVE IDs does GHSA-4fcw-pq4r-f4q7 cover?

GHSA-4fcw-pq4r-f4q7 covers the following CVE IDs: CVE-2020-9298. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4fcw-pq4r-f4q7?

GHSA-4fcw-pq4r-f4q7 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-4fcw-pq4r-f4q7?

GHSA-4fcw-pq4r-f4q7 affects 1 product, including: maven/com.netflix.spinnaker.orca:orca-core:\u003c 8.7.0.

GHSA-4fcw-pq4r-f4q7HighCVSS 7.5

Server-Side Request Forgery in Spinnaker Orca

Vendor

GitHub Security Advisories

Published

May 7, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-9298 →

📋 Description

The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure.

🎯 Affected products1

maven/com.netflix.spinnaker.orca:orca-core:< 8.7.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-9298
https://github.com/spinnaker/orca/pull/3706/commits/4f3c07da8fcacd67bb1984aef11b2066f2c0d11c
https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-003.md
https://github.com/spinnaker/orca/releases/tag/v8.7.0
https://github.com/advisories/GHSA-4fcw-pq4r-f4q7