Riverbed · Sd-Wan Orchestrator · CVE-2020-3984
**Name of the Vulnerable Software and Affected Versions**
SD-WAN Orchestrator versions 3.3.2 through 3.3.2 P3
SD-WAN Orchestrator versions 3.4.x through 3.4.4
**Description**
The issue is related to incorrect input validation, which allows for SQL-injection. An authenticated user may exploit a vulnerable API call using specially crafted SQL queries, potentially leading to unauthorized data access.
**Recommendations**
For SD-WAN Orchestrator versions 3.3.2 through 3.3.2 P3, update to version 3.3.2 P3 or later.
For SD-WAN Orchestrator versions 3.4.x through 3.4.4, update to version 3.4.4 or later.
As a temporary workaround, consider restricting access to vulnerable API calls until a patch is available.