CVE-2020-12147mediumCWE-22

CVE-2020-12147: falha de média gravidade em Silver Peak Systems, Inc. Unity Orchestrator

Unauthorized queries against the Silver Peak Unity OrchestratorTM MySQL database.

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Unity Orchestrator

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.6epss 1.5%
In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Silver Peak Systems, Inc. · Unity Orchestrator
CVEs relacionadas — Silver Peak Systems, Inc. Unity Orchestrator

No mesmo produto, das mais perigosas para as menos.

CVE-2020-12146MEDIUMSilver Peak Unity OrchestratorTM subject to path traversal.EPSS 27.6%CVE-2020-12145MEDIUMSilver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers.EPSS 6.0%