Vulnerability · Published Nov 5, 2020 · Assigned by Silver Peak
CVE-2020-12146Silver Peak Unity OrchestratorTM subject to path traversal.
Medium 6.6
In plain English
A medium-severity path traversal in Unity Orchestrator from Silver Peak Systems, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 27.6% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)27.6%top 1.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can access, modify, and delete restricted files on the Orchestrator server using the/debugFiles REST API.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Silver Peak Systems, Inc. | Unity Orchestrator | All versions affected prior to Silver Peak Unity Orchestrator 8.9.11+8.10.11+or 9.0.1+. |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H