Description
The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Netflix Orca Spinnaker | All versions prior to version v8.7.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.netflix.spinnaker.orca:orca-core | < 8.7.0 | 8.7.0 | GHSA-4fcw-pq4r-f4q7 |