CVE-2020-3973 - The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection

Back Back to CVE browser

HIGH

The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection

Published Jul 8, 2020

8.8

HIGH

CVSS 3.1

EPSS 1.13%

Description

The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted SQL queries and obtain data to which they are not privileged.

Affected products

Vendor n/a Product VMware SD-WAN by VeloCloud Default
n/a
- Version
  VMware SD-WAN by VeloCloud 3.2.x, 3.3.x prior to 3.3.2 p2, 3.4.x prior to 3.4.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

VMware SD-WAN by VeloCloud

n/a

Version	Status	Constraints
VMware SD-WAN by VeloCloud 3.2.x, 3.3.x prior to 3.3.2 p2, 3.4.x prior to 3.4.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (1)

https://www.vmware.com/security/advisories/VMSA-2020-0016.html
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://www.vmware.com/security/advisories/VMSA-2020-0016.html		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner vmware

Published Jul 8, 2020

Updated Aug 4, 2024

Reserved Dec 30, 2019

Link CVE-2020-3973

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jul 28, 2026

Link CVE-2020-3973

Red Hat

Severity n/a

Public date n/a

Links CVE-2020-3973