CVE-2021-39143— Path Traversal in spinnaker
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-39143
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path Traversal in spinnaker
Source: NVD (National Vulnerability Database)
Vulnerability Description
Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngine for deployments. This uses a utility to extract files locally for deployment without validating the paths in that deployment don't override system files. This would allow an attacker to override files on the container, POTENTIALLY introducing a MITM type attack vector by replacing libraries or injecting wrapper files. Users are advised to update as soon as possible. For users unable to update disable Google AppEngine deployments and/or disable artifacts that provide TARs.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Spinnaker 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Spinnaker是一个持续交付平台。用于以高速度和信心发布软件变更。 Spinnaker 存在路径遍历漏洞，该漏洞允许攻击者覆盖容器上的文件，通过替换库或注入包装文件引入 MITM 类型的攻击向量。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-39143
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-39143
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: spinnaker
- CVE-2026-32613
Spinnaker vulnerable to RCE via expression parsing due to un - CVE-2026-32604
Spinnaker vulnerable to RCE when using gitrepo artifact type - CVE-2025-61916
Spinnaker vulnerable to SSRF due to improper restrictions on - CVE-2023-39348
Improper log output when using GitHub Status Notifications i - CVE-2022-23506
Spinnaker's Rosco microservice vulnerable to improper log ma
Same vendor: spinnaker
- CVE-2026-32613
Spinnaker vulnerable to RCE via expression parsing due to un - CVE-2026-32604
Spinnaker vulnerable to RCE when using gitrepo artifact type - CVE-2025-61916
Spinnaker vulnerable to SSRF due to improper restrictions on - CVE-2023-39348
Improper log output when using GitHub Status Notifications i - CVE-2022-23506
Spinnaker's Rosco microservice vulnerable to improper log ma
Same weakness: CWE-22
- CVE-2026-8274
npitre cramfs-tools Directory cramfsck.c do_directory path t - CVE-2022-50956
WordPress Plugin amministrazione-aperta 3.7.3 Local File Rea - CVE-2026-8215
Industrial Application Software IAS Canias ERP RMI iasReques - CVE-2026-42605
AzuraCast: Path Traversal in `currentDirectory` Parameter En - CVE-2026-42574
apko dirFS has a symlink-following path traversal that allow
V. Comments for CVE-2021-39143
No comments yet