VMware Releases Security Update for VeloCloud

Threat ID:: CC-3542
Threat Severity:: Low
Published:: 9 July 2020 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Affected platforms

The following platforms are known to be affected:

VMware SD-WAN by VeloCloud - all versions

Threat details

Vulnerability

VMware has released a security update to address a vulnerability in VeloCloud. An attacker could exploit this vulnerability to obtain sensitive information.

Remediation advice

Users and administrators are encouraged to review VMware security advisory VMSA-2020-0016 and apply the necessary update.

Remediation steps

Type	Step
Patch	Apple the necessary updates. https://www.vmware.com/security/advisories/VMSA-2020-0016.html

CVE Vulnerabilities

Status Master

CVE-2020-3973

The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted SQL queries and obtain data to which they are not privileged.

Last edited: 9 July 2020 10:40 am