« Volver al listado

CVE-2020-12147

Estado: ModificadaAlta (8.8)—

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Silver-peak — Unity Orchestrator

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-12147",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "sirt@silver-peak.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.6,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.7
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "sirt@silver-peak.com",
      "affectedData": [
        {
          "vendor": "Silver Peak Systems, Inc.",
          "product": "Unity Orchestrator",
          "versions": [
            {
              "status": "affected",
              "version": "All versions affected prior to Silver Peak Unity Orchestrator 8.9.11+"
            },
            {
              "status": "affected",
              "version": "8.10.11+"
            },
            {
              "status": "affected",
              "version": "or 9.0.1+."
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-11-05T19:15:12.693",
  "references": [
    {
      "url": "https://www.silver-peak.com/support/user-documentation/security-advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "sirt@silver-peak.com"
    },
    {
      "url": "https://www.silver-peak.com/support/user-documentation/security-advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "sirt@silver-peak.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing."
    },
    {
      "lang": "es",
      "value": "En Silver Peak Unity Orchestrator versiones anteriores a 8.9.11+, 8.10.11+ o 9.0.1+, un usuario autenticado puede llevar a cabo consultas MySQL no autorizadas en la base de datos de Orchestrator usando la API REST /sqlExecution, que había sido usada para pruebas internas"
    }
  ],
  "lastModified": "2026-06-17T02:51:29.437",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:silver-peak:unity_orchestrator:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F57E088F-B275-47E0-87E9-D392F5E78CA7",
              "versionEndExcluding": "8.9.11\\+"
            },
            {
              "criteria": "cpe:2.3:a:silver-peak:unity_orchestrator:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06BDDCC0-D63B-4729-9FB7-95B89A54389A",
              "versionEndExcluding": "8.10.11\\+",
              "versionStartIncluding": "8.10"
            },
            {
              "criteria": "cpe:2.3:a:silver-peak:unity_orchestrator:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5302B8F8-6B84-48F0-BD59-8FF7368AB888",
              "versionEndExcluding": "9.0.1\\+",
              "versionStartIncluding": "9.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "sirt@silver-peak.com"
}