Velocloud Orchestrator On Prem
Monthly
An authenticated SQL injection in an API component of Arista's VeloCloud Orchestrator On-Prem allows a user holding valid credentials to manipulate backend queries, exposing data beyond their intended privileges and causing the orchestrator to initiate unintended outbound network connections. Only on-prem installations on the 5.2.0, 6.1.0 and 6.4.0 branches before 5.2.3.14, 6.1.3.4 and 6.4.2.4 are affected; exploitation requires a working authenticated session (CVSS vector PR:L), so anonymous attacks are not possible, and exposure is further narrowed because the orchestrator management plane is normally reachable only from admin or management networks. EPSS is 2.83% (85th percentile) with no public exploit code and no active exploitation reported, and while the vendor's CVSS 4.0 base score is 8.5, our independent assessment treats this as a moderate-priority rather than top-priority issue given the authentication prerequisite and the on-prem-only, restricted-reachability attack surface.
Server-side request forgery in Arista VeloCloud Orchestrator On-Prem lets an authenticated tenant account with at least the Enterprise Standard Admin role induce the Orchestrator to issue requests to internal services that are otherwise unreachable, because a VCO feature fails to sufficiently validate caller-supplied input. Impact is scoped to subsequent systems rather than the Orchestrator itself (low confidentiality/integrity, no availability effect), so real risk depends on what internal services a given deployment can route to. No public exploit code or active exploitation is known - Arista discovered the issue internally and confirms no malicious use in customer networks - although EPSS places it around the 82nd percentile, and vendor patches are available for the affected release trains.
An authenticated SQL injection in an API component of Arista's VeloCloud Orchestrator On-Prem allows a user holding valid credentials to manipulate backend queries, exposing data beyond their intended privileges and causing the orchestrator to initiate unintended outbound network connections. Only on-prem installations on the 5.2.0, 6.1.0 and 6.4.0 branches before 5.2.3.14, 6.1.3.4 and 6.4.2.4 are affected; exploitation requires a working authenticated session (CVSS vector PR:L), so anonymous attacks are not possible, and exposure is further narrowed because the orchestrator management plane is normally reachable only from admin or management networks. EPSS is 2.83% (85th percentile) with no public exploit code and no active exploitation reported, and while the vendor's CVSS 4.0 base score is 8.5, our independent assessment treats this as a moderate-priority rather than top-priority issue given the authentication prerequisite and the on-prem-only, restricted-reachability attack surface.
Server-side request forgery in Arista VeloCloud Orchestrator On-Prem lets an authenticated tenant account with at least the Enterprise Standard Admin role induce the Orchestrator to issue requests to internal services that are otherwise unreachable, because a VCO feature fails to sufficiently validate caller-supplied input. Impact is scoped to subsequent systems rather than the Orchestrator itself (low confidentiality/integrity, no availability effect), so real risk depends on what internal services a given deployment can route to. No public exploit code or active exploitation is known - Arista discovered the issue internally and confirms no malicious use in customer networks - although EPSS places it around the 82nd percentile, and vendor patches are available for the affected release trains.