An authenticated SQL injection vulnerability in Arista VeloCloud Orchestrator On-Prem allows low-privileged users to manipulate backend queries and potentially force unauthorized network connections.

This is an SQL injection vulnerability (CWE-89) within an API component of the orchestrator. Exploitation requires authenticated access (PR:L), where an attacker can manipulate backend queries to bypass intended privilege constraints.

The CVSS score of 9.1 reflects the potential for severe impact despite the authentication requirement. Unauthorized access to orchestrator data could expose network configurations, while the ability to force outbound network connections could facilitate internal reconnaissance or data exfiltration.

Immediate Action: Upgrade to the fixed releases: VCO 5.2.3.14, 6.1.3.4, 6.4.2.4, or later versions.

Proactive Monitoring: Monitor API access logs for anomalous SQL patterns or unexpected outbound network traffic initiated by the Orchestrator service.

Compensating Controls: Implement strict API rate limiting and review user permissions to ensure the principle of least privilege is enforced for all accounts with access to the Orchestrator.

Public Exploit Available: No (exploit_available: false)

While the vulnerability requires authentication, the impact on internal network orchestration is significant. Administrators should schedule the recommended firmware upgrades during the next available maintenance window to mitigate the risk of internal privilege escalation and unauthorized outbound communication.