Lucene search

FidelisCVE-2022-24389

HistoryMay 17, 2022 - 8:15 p.m.

CVE-2022-24389

2022-05-1720:15:08

CWE-78

CWE-77

Fidelis

web.nvd.nist.gov

cve-2022-24389

rconfig

command injection

fidelis network

deception

vulnerability

security patch

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.002

Percentile

59.4%

JSON

Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.

Affected configurations

Nvd

Node

fidelissecuritydeceptionRange<9.4.5

fidelissecuritynetworkRange<9.4.5

VendorProductVersionCPE
fidelissecuritydeception*cpe:2.3:a:fidelissecurity:deception:*:*:*:*:*:*:*:*
fidelissecuritynetwork*cpe:2.3:a:fidelissecurity:network:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fidelissecurity	deception	*	cpe:2.3:a:fidelissecurity:deception::::::::
fidelissecurity	network	*	cpe:2.3:a:fidelissecurity:network::::::::

CNA Affected

[
  {
    "platforms": [
      "CentOS"
    ],
    "product": "Fidelis Network",
    "vendor": "Fidelis Cybersecurity",
    "versions": [
      {
        "lessThan": "9.4.5",
        "status": "affected",
        "version": "Fidelis Network",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "CentOS"
    ],
    "product": "Fidelis Deception",
    "vendor": "Fidelis Cybersecurity",
    "versions": [
      {
        "lessThan": "9.4.5",
        "status": "affected",
        "version": "Fidelis Deception",
        "versionType": "custom"
      }
    ]
  }
]

References

fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.002

Percentile

59.4%

JSON

Related for CVE-2022-24389