CVE-2020-12145: Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticat

This month

MEDIUM 6.6DOWNGRADE

CVE-2020-12145 is a medium-severity flaw (CVSS 6.6) affecting unity orchestrator. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. Orchestrator instances that are hosted by customers –on-premise or in a public cloud provider –are affected by this vulnerability.

Why this priority

EPSS top 7%: very likely to be exploited

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	6.6 (Medium)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	High
User interaction	None
EPSS exploit chance	6.0% (top 7%)
CISA exploited list	No
Weakness	CWE-287
Published	2020-11-05
Last modified	2026-06-17

Publisher (CNA): Silver Peak Systems, Inc. · Vendor: silver-peak

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2020-11-05 19:15 UTCPublished CVE record published
2026-06-17 02:51 UTCUpdated Record last modified

silver-peak unity orchestrator DOWNGRADE

Affected: < 8.9.11\+ · >= 8.10 and < 8.10.11\+ · >= 9.0 and < 9.0.1\+

Fixed in: 8.9.11\+, 8.10.11\+, 9.0.1\+

Safe to downgrade to: a release before 8.10

1. Check installed version

apt-cache policy unity-orchestrator || rpm -q unity-orchestrator || unity-orchestrator --version

2. No fixed release: DOWNGRADE to a release before 8.10 (Debian / Ubuntu)

apt-cache madison unity-orchestrator sudo apt install unity-orchestrator=<VERSION_BEFORE_8.10> sudo apt-mark hold unity-orchestrator

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list unity-orchestrator sudo dnf downgrade unity-orchestrator-<VERSION_BEFORE_8.10> sudo dnf versionlock add unity-orchestrator

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-12145?

unity orchestrator: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2020-12145 being exploited?

CVE-2020-12145 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-12145 affect?

CVE-2020-12145 affects unity orchestrator. Severity is medium (CVSS 6.6). Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.

How urgent is CVE-2020-12145?

Priority 46/100. EPSS top 7%: very likely to be exploited

Software pages

Unity vulnerabilities

Related CVEs

CVE-2020-12147 MEDIUM 6.6 DOWNGRADE In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can ma
CVE-2020-12146 MEDIUM 6.6 DOWNGRADE In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can ac
CVE-2020-12144 MEDIUM 6.0 MITIGATE MITIGATE The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated
CVE-2020-12143 MEDIUM 6.0 MITIGATE MITIGATE The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible
CVE-2020-12142 MEDIUM 4.8 MITIGATE MITIGATE 1

References

← Back to latest CVEs