{"id":"CVE-2020-9298","aliases":["GHSA-4fcw-pq4r-f4q7"],"url":"https://o3.security/vulnerability/CVE-2020-9298","summary":"Server-Side Request Forgery in Spinnaker Orca","details":"The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure.","published":"2020-08-28T15:15:12.407Z","modified":"2026-07-09T01:06:13.483475Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"com.netflix.spinnaker.orca:orca-core","fixedVersion":"8.7.0"}],"fix":null,"references":[{"type":"FIX","url":"https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-003.md"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T01:06:13.483475Z"}}