CVE-2020-12145— Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers.
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-12145
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers.
Source: NVD (National Vulnerability Database)
Vulnerability Description
Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. Orchestrator instances that are hosted by customers –on-premise or in a public cloud provider –are affected by this vulnerability.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Silver Peak Systems Silver Peak Unity Orchestrator 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Silver Peak Systems Silver Peak Unity Orchestrator是美国Silver Peak Systems公司的一个用于跨WAN环境下网络管理的软件。该软件可提供对网络进行进行集中编排的方式，对网络状态进行可视化的管理。 Silver Peak Unity Orchestrator 8.9.11+之前版本, 8.10.11+版本, or 9.0.1+版本存在安全漏洞，该漏洞通过引入设置为127.0.0.1或本地主机的HTTP HOST标头，可以登录Orchestrat
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Silver Peak Systems, Inc. | Unity Orchestrator | All versions affected prior to Silver Peak Unity Orchestrator 8.9.11+ | - |
II. Public POCs for CVE-2020-12145
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-12145
请登录查看更多情报信息。
Same Patch Batch · Silver Peak Systems, Inc. · 2020-11-05 · 3 CVEs total
| CVE-2020-12146 | 6.6 MEDIUM | Silver Peak Unity OrchestratorTM subject to path traversal. |
| CVE-2020-12147 | 6.6 MEDIUM | Unauthorized queries against the Silver Peak Unity OrchestratorTM MySQL database. |
IV. Related Vulnerabilities
Same vendor: Silver Peak Systems, Inc.
- CVE-2020-12148
OS Command Injection - nslookup API - CVE-2020-12149
OS Command Injection - Management File Upload - CVE-2020-12146
Silver Peak Unity OrchestratorTM subject to path traversal. - CVE-2020-12147
Unauthorized queries against the Silver Peak Unity Orchestra - CVE-2020-12142
IPSec UDP key material can be retrieved from EdgeConnect by
V. Comments for CVE-2020-12145
No comments yet