CVE-2020-3984: SQL Injection

Q: What is the severity of CVE-2020-3984?

CVE-2020-3984 is rated as a critical vulnerability due to its potential for SQL injection and unauthorized data access.

Q: How do I fix CVE-2020-3984?

To fix CVE-2020-3984, upgrade to SD-WAN Orchestrator version 3.3.2 P3 or 3.4.4 or later.

Q: Who is affected by CVE-2020-3984?

CVE-2020-3984 affects VMware SD-WAN Orchestrator versions 3.3.2 and 3.4.x prior to 3.4.4.

Q: What type of vulnerability is CVE-2020-3984?

CVE-2020-3984 is an SQL injection vulnerability that arises from improper input validation.

Q: Can CVE-2020-3984 be exploited remotely?

CVE-2020-3984 requires an authenticated user to exploit the vulnerability through a vulnerable API call.

Published Nov 24, 2020

Updated

The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 does not apply correct input validation which allows for SQL-injection. An authenticated SD-WAN Orchestrator user may exploit a vulnerable API call using specially crafted SQL queries which may lead to unauthorized data access.

Affected Software

4 affected components

VMware SD-WAN Orchestrator>=3.4.0<3.4.4

VMware SD-WAN Orchestrator=3.3.2

VMware SD-WAN Orchestrator=3.3.2-p1

VMware SD-WAN Orchestrator=3.3.2-p2

Event History

Nov 24, 2020

CVE Published

via MITRE·03:34 PM

Data Sourced

via MITRE·03:34 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-3984?

CVE-2020-3984 is rated as a critical vulnerability due to its potential for SQL injection and unauthorized data access.

How do I fix CVE-2020-3984?

To fix CVE-2020-3984, upgrade to SD-WAN Orchestrator version 3.3.2 P3 or 3.4.4 or later.

Who is affected by CVE-2020-3984?

CVE-2020-3984 affects VMware SD-WAN Orchestrator versions 3.3.2 and 3.4.x prior to 3.4.4.

What type of vulnerability is CVE-2020-3984?

CVE-2020-3984 is an SQL injection vulnerability that arises from improper input validation.

Can CVE-2020-3984 be exploited remotely?