CVE-2021-43832— Improper Access Control in spinnaker
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-43832
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Access Control in spinnaker
Source: NVD (National Vulnerability Database)
Vulnerability Description
Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an arbitrary user with access to the gate endpoint to create a pipeline and execute it without authentication. If users haven't setup Role-based access control (RBAC) with-in spinnaker, this enables remote execution and access to deploy almost any resources on any account. Patches are available on the latest releases of the supported branches and users are advised to upgrade as soon as possible. Users unable to upgrade should enable RBAC on ALL accounts and applications. This mitigates the ability of a pipeline to affect any accounts. Block application access unless permission are enabled. Users should make sure ALL application creation is restricted via appropriate wildcards.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
关键功能的认证机制缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
Spinnaker 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Spinnaker是一个持续交付平台。用于以高速度和信心发布软件变更。 Spinnaker 存在访问控制错误漏洞，该漏洞源于软件存在不适当的权限，允许管道创建和执行。这允许具有gate端点访问权的任意用户创建一个管道并在不需要身份验证的情况下执行它。如果用户没有在spinnaker中设置基于角色的访问控制(RBAC)，这将允许远程执行和访问在任何帐户上部署任何资源。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-43832
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-43832
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: spinnaker
- CVE-2026-32613
Spinnaker vulnerable to RCE via expression parsing due to un - CVE-2026-32604
Spinnaker vulnerable to RCE when using gitrepo artifact type - CVE-2025-61916
Spinnaker vulnerable to SSRF due to improper restrictions on - CVE-2023-39348
Improper log output when using GitHub Status Notifications i - CVE-2022-23506
Spinnaker's Rosco microservice vulnerable to improper log ma
Same vendor: spinnaker
- CVE-2026-32613
Spinnaker vulnerable to RCE via expression parsing due to un - CVE-2026-32604
Spinnaker vulnerable to RCE when using gitrepo artifact type - CVE-2025-61916
Spinnaker vulnerable to SSRF due to improper restrictions on - CVE-2023-39348
Improper log output when using GitHub Status Notifications i - CVE-2022-23506
Spinnaker's Rosco microservice vulnerable to improper log ma
Same weakness: CWE-306
- CVE-2021-47940
WordPress Download From Files 1.48 Arbitrary File Upload - CVE-2021-47936
OpenCATS 0.9.4 Remote Code Execution via Resume Upload - CVE-2021-47933
WordPress MStore API 2.0.6 Arbitrary File Upload - CVE-2026-8185
UGREEN CM933 Administrative missing authentication - CVE-2026-42302
FastGPT: Unauthenticated Remote Code Execution (RCE) via cod
V. Comments for CVE-2021-43832
No comments yet