CVE-2020-12145 — Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers.

CVE-2020-12145

Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers. PUBLISHED

Description (CNA)

Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. Orchestrator instances that are hosted by customers –on-premise or in a public cloud provider –are affected by this vulnerability.

Affected (CNA)

Vendor / product	Versions
Silver Peak Systems, Inc. / Unity Orchestrator	affected All versions affected prior to Silver Peak Unity Orchestrator 8.9.11+; affected 8.10.11+; affected or 9.0.1+.

CWE

CWE-287

References

https://www.silver-peak.com/support/user-documentation/security-advisories

ADP enrichment

CVE

No English description supplied.

https://www.silver-peak.com/support/user-documentation/security-advisories