What is CVE-2020-9301?

CVE-2020-9301 is a high-severity vulnerability in Linuxfoundation Spinnaker, classified under Deserialization of Untrusted Data. CVSS score: 8.8/10. Published 2020-12-11.

How severe is CVE-2020-9301?

High severity. CVSS v3 base score is 8.8 out of 10.

Deserialization in Linuxfoundation Spinnaker

CVE-2020-9301

Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnerability exists within the handling of SpEL expressions that allows an attacker to read and write arbitrary files within the orca container via authenticated HTTP POST requests.

Vulnerability class: Insecure Deserialization

EPSS: 0.015 (72.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Linuxfoundation Spinnaker
N/a Netflix Spinnaker — versions All versions prior to version 1.23.4, 1.22.4 or 1.21.5

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

security-report@netflix.com (x_refsource_CONFIRM, Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2020-9301?: CVE-2020-9301 is a high-severity vulnerability in Linuxfoundation Spinnaker, classified under Deserialization of Untrusted Data. CVSS score: 8.8/10. Published 2020-12-11.
How severe is CVE-2020-9301?: High severity. CVSS v3 base score is 8.8 out of 10.