CVE-2021-35049
Assigner: Fidelis
Published: 2021-06-18T00:00:00
State: PUBLISHED
affected: platforms: CentOS
product: Fidelis Network
vendor: Fidelis Cybersecurity
versions: status: affected
version: Fidelis Network 9.4
lessThan: 9.3.7
status: affected
version: Fidelis Network
versionType: custom
platforms: CentOS
product: Fidelis Deception
vendor: Fidelis Cybersecurity
versions: status: affected
version: Fidelis Deception 9.4
lessThan: 9.3.7
status: affected
version: Fidelis Deception
versionType: custom
credits: value: Ryan Wincey(@rwincey), Securifera
datePublic: 2021-06-18T00:00:00
descriptions: value: Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response in an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.
exploits: value: Command Injection
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-89
description: CWE-89 SQL Injection
type: CWE
solutions: value: Upgrade to version 9.3.7 or version 9.4.1.
Or apply patches to version 9.3.6 or version 9.4.
source: discovery: EXTERNAL
title: Command Injection Vulnerability in Fidelis Network and Deception
x_generator: engine: Vulnogram 0.0.9