VULNERABILITY INTELLIGENCE

CVE-2020-12147

CVSS score6.6 MEDIUM
EPSS probability1.52%
CISA KEVNot currently listed
Published2020-11-05
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing.

Weakness classification

  • sirt@silver-peak.com: CWE-22
  • nvd@nist.gov: CWE-22

Primary references