Lucene search

[email protected]CVE-2021-35050

HistoryJun 25, 2021 - 12:15 p.m.

CVE-2021-35050

2021-06-2512:15:08

CWE-257

CWE-522

[email protected]

web.nvd.nist.gov

cve-2021-35050

fidelis network

deception

commandpost

security vulnerability

credentials

data storage

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.3%

JSON

User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.3. This vulnerability has been addressed in version 9.3.3 and subsequent versions.

Affected configurations

NVD

Node

fidelissecuritydeceptionRange<9.3.3

fidelissecuritynetworkRange<9.3.3

CPENameOperatorVersion
fidelissecurity:deceptionfidelissecurity deceptionlt9.3.3
fidelissecurity:networkfidelissecurity networklt9.3.3

CPE	Name	Operator	Version
fidelissecurity:deception	fidelissecurity deception	lt	9.3.3
fidelissecurity:network	fidelissecurity network	lt	9.3.3

CNA Affected

[
  {
    "platforms": [
      "CentOS"
    ],
    "product": "Fidelis Network",
    "vendor": "Fidelis Cybersecurity",
    "versions": [
      {
        "lessThan": "9.3.3",
        "status": "affected",
        "version": "Fidelis Network",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "CentOS"
    ],
    "product": "Fidelis Deception",
    "vendor": "Fidelis Cybersecurity",
    "versions": [
      {
        "lessThan": "9.3.3",
        "status": "affected",
        "version": "Fidelis Deception",
        "versionType": "custom"
      }
    ]
  }
]

References

support.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-Policies

www.securifera.com/blog/2021/06/24/operation-eagle-eye/

Social References

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.3%

JSON

Related for CVE-2021-35050

cvelist1 prion1 nvd1