CVE-2020-3985 - The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 allows an access to set arbitrary authorization levels leading to a privilege escalation issue

Back Back to CVE browser

HIGH

The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 allows an access to set arbitrary authorization levels leading to a privilege escalation issue

Published Nov 24, 2020

8.8

HIGH

CVSS 3.1

EPSS 1.42%

Description

The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 allows an access to set arbitrary authorization levels leading to a privilege escalation issue. An authenticated SD-WAN Orchestrator user may exploit an application weakness and call a vulnerable API to elevate their privileges.

Affected products

Vendor n/a Product VMware SD-WAN Orchestrator Default
n/a
- Version
  VMware SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4.
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

VMware SD-WAN Orchestrator

n/a

Version	Status	Constraints
VMware SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4.	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (1)

http://www.vmware.com/security/advisories/VMSA-2020-0025.html
x_refsource_MISCVendor Advisory

Link	Providers	Tags
http://www.vmware.com/security/advisories/VMSA-2020-0025.html		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner vmware

Published Nov 24, 2020

Updated Aug 4, 2024

Reserved Dec 30, 2019

Link CVE-2020-3985

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-3985

Red Hat

Severity n/a

Public date n/a

Links CVE-2020-3985