Vulnerability · Published Nov 5, 2020 · Assigned by Silver Peak
CVE-2020-12147Unauthorized queries against the Silver Peak Unity OrchestratorTM MySQL database.
Medium 6.6
In plain English
A medium-severity path traversal in Unity Orchestrator from Silver Peak Systems, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)1.5%top 25.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Silver Peak Systems, Inc. | Unity Orchestrator | All versions affected prior to Silver Peak Unity Orchestrator 8.9.11+8.10.11+or 9.0.1+. |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H