CVE-2021-35048: fallo crítico en Fidelis Network
Unauthenticated SQL Injection Vulnerability in Fidelis Network and Deception
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 1.3%
Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerability could lead to exposure of authentication tokens in some versions of Fidelis software. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVEs relacionadas — Fidelis Network
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-35049CRITICALCommand Injection Vulnerability in Fidelis Network and DeceptionEPSS 4.6%CVE-2022-24392HIGHAuthenticated Command Injection Vulnerability in Fidelis Network and DeceptionEPSS 2.6%CVE-2022-24393HIGHAuthenticated Command Injection Vulnerability in Fidelis Network and DeceptionEPSS 2.6%CVE-2022-24394HIGHAuthenticated Command Injection Vulnerability in Fidelis Network and DeceptionEPSS 2.6%CVE-2021-35047CRITICALPrivileged Command Injection Vulnerability in Fidelis Network and DeceptionEPSS 1.6%CVE-2022-24388HIGHAuthenticated Privileged Command Injection Vulnerability in Fidelis Network and DeceptionEPSS 1.5%