CVE-2020-12145 Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers.
Attackers can bypass authentication and gain administrative access to Silver Peak Unity Orchestrator by spoofing HTTP headers to appear as localhost.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12145?
CVE-2020-12145 is a medium-severity authentication bypass vulnerability in Silver Peak Systems, Inc. Unity Orchestrator, published on 5 Nov 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. Orchestrator instances that are hosted by customers –on-premise or in a public cloud provider –are affected by this vulnerability.
Weakness: CWE-287
Which versions are affected by CVE-2020-12145?
It affects 1 product.
Products include Silver-Peak Unity Orchestrator.
How do I fix CVE-2020-12145?
No fix has been published for CVE-2020-12145 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-12145 being exploited?
There is no known exploitation of CVE-2020-12145 in the wild and no public exploit code.
Other vulnerabilities in Silver Peak Systems, Inc. Unity Orchestrator
Sources
Also known as GHSA-q4mf-j4qj-96f2.