Arista Networks has named the upgrade releases that address an actively exploited SQL injection flaw across three on-premises VeloCloud Orchestrator branches, where low-level accounts can obtain operator privileges.
Network access to the VeloCloud web interface and a valid authenticated session are required, according to Arista’s Oct. 22 security advisory. The company says an account with Enterprise Read Only, its lowest built-in tenant role, is sufficient to gain operator privileges.
Arista identifies version 5.2.3.18 or later as fixed in the 5.2 branch, 6.1.3.10 or later in 6.1, and 6.4.2.12 or later in 6.4. Earlier releases in those branches are affected. The advisory does not assess versions that have reached end of support.
Arista says it has also patched hosted and dedicated VeloCloud deployments. Its July and September advisories described active exploitation of other VeloCloud Orchestrator vulnerabilities.
While applying the upgrade, administrators should allow portal connections only from trusted management networks and review access records for anomalous activity, Arista advises. For suspected incidents, secure VCO access, application, system and database logs, and retain relevant file-system timestamps before beginning cleanup when practical.
