CVE-2020-12145
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2020
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers.
Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. Orchestrator instances that are hosted by customers –on-premise or in a public cloud provider –are affected by this vulnerability.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Unity Orchestrator
- Vendor
- Silver Peak Systems, Inc.
- Product
- Unity Orchestrator
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| All versions affected prior to Silver Peak Unity Orchestrator 8.9.11+ | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.10.11+ | affected | Unavailable | Unavailable | Unavailable | None listed |
| or 9.0.1+. | affected | Unavailable | Unavailable | Unavailable | None listed |