CVEvulnerability

CVE-2020-12145

9.8 CRITICAL Published 2020-11-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-11-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.6 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-287

Description

Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. Orchestrator instances that are hosted by customers –on-premise or in a public cloud provider –are affected by this vulnerability.

Affected configurations

• silver-peak unity orchestrator (< 8.9.11\+) • silver-peak unity orchestrator (>= 8.10 < 8.10.11\+) • silver-peak unity orchestrator (>= 9.0 < 9.0.1\+)

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References