Velocloud Orchestrator
Monthly
Privilege escalation through SQL injection in on-premises Arista VeloCloud Orchestrator lets any valid VCO account cross into operator-level access and impersonate the built-in superuser operator, reaching internal-only functions and potentially compromising the orchestrator host and managed data. The vendor rates the issue CVSS 9.4; hosted and Dedicated VCO deployments were affected and are reported already patched, so on-prem VCO is the remediation focus, and the supplied priority label is act_now. No public exploit identified at time of analysis, and no CISA KEV status is supplied in the provided intelligence.
Command injection vulnerability in VeloCloud Orchestrator (VCO) on-premises allows unauthenticated remote attackers to access internal functionality and fully compromise the host system, impacting data managed by the orchestrator. This issue is known to be actively exploited. Hosted and Dedicated VCO versions have been pre-emptively patched.
The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation through SQL injection in on-premises Arista VeloCloud Orchestrator lets any valid VCO account cross into operator-level access and impersonate the built-in superuser operator, reaching internal-only functions and potentially compromising the orchestrator host and managed data. The vendor rates the issue CVSS 9.4; hosted and Dedicated VCO deployments were affected and are reported already patched, so on-prem VCO is the remediation focus, and the supplied priority label is act_now. No public exploit identified at time of analysis, and no CISA KEV status is supplied in the provided intelligence.
Command injection vulnerability in VeloCloud Orchestrator (VCO) on-premises allows unauthenticated remote attackers to access internal functionality and fully compromise the host system, impacting data managed by the orchestrator. This issue is known to be actively exploited. Hosted and Dedicated VCO versions have been pre-emptively patched.
The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.