CVE-2020-3973

HighCVSS 8.8

Published: 08/07/2020(UTC)Updated: 28/07/2026(UTC)Translated: 28/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.12%

63th percentile - higher than 63% of all known CVEs

Summary

VeloCloud Orchestrator does not apply correct input validation, allowing blind SQL injection. A malicious actor with tenant access can enter crafted SQL queries and obtain unauthorized data.

Risk Assessment

An attacker can read sensitive data from the database without authorization, compromising data confidentiality and potentially enabling further attacks.

Recommendation

Apply the vendor patch that introduces proper input validation to prevent SQL injection.

Other vulnerabilities in VeloCloud Orchestrator

CVE-2026-16812CriticalActively exploited
VeloCloud Orchestrator (VCO) on-prem has a vulnerability that allows a remote attacker to access privileged internal functionality, impacting the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and managed data. This issue is actively exploited.

Original NVD description (English source)

The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted SQL queries and obtain data to which they are not privileged.