Lucene search

K
cvelistSilver PeakCVELIST:CVE-2020-12144
HistoryMay 05, 2020 - 7:54 p.m.

CVE-2020-12144 The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated

2020-05-0519:54:00
CWE-295
Silver Peak
www.cve.org
2

CVSS3

6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H

AI Score

6

Confidence

High

EPSS

0.001

Percentile

22.7%

The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated. This makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted portal.

CNA Affected

[
  {
    "product": "1. Unity EdgeConnect, NX, VX 2. Unity Orchestratorā€Æ  3. EdgeConnect in AWS, Azure, GCPā€Æ",
    "vendor": "Silver Peak Systems, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "All versions affected prior to Silver Peak Unity ECOSā„¢ 8.3.2+, 8.1.9.12+ and Silver Peak Unity Orchestratorā„¢ 8.9.2+"
      }
    ]
  }
]

CVSS3

6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H

AI Score

6

Confidence

High

EPSS

0.001

Percentile

22.7%

Related for CVELIST:CVE-2020-12144