CVE-2022-0486

🗓️ 17 May 2022 19:32:58Reported by FidelisType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 81 Views🌐 WEB

Improper file permissions in Fidelis Network and Deception allow local admin to escalate privileges (CVE-2022-0486

Reporter	Title	Published	Views	Family All 9
GithubExploit	Exploit for Incorrect Default Permissions in Fidelissecurity Deception	3 Jun 202205:06	–	githubexploit
ATTACKERKB	CVE-2022-0486	16 May 202215:30	–	attackerkb
CNNVD	Fidelis Network Deception 安全漏洞	17 May 202200:00	–	cnnvd
CNVD	Fidelis Network Deception has an unspecified vulnerability (CNVD-2022-59167)	19 May 202200:00	–	cnvd
Cvelist	CVE-2022-0486 Privileged Command Injection Vulnerability in Fidelis Network and Deception	17 May 202219:32	–	cvelist
EUVD	EUVD-2022-15623	3 Oct 202520:07	–	euvd
NVD	CVE-2022-0486	17 May 202220:15	–	nvd
OSV	CVE-2022-0486	17 May 202220:15	–	osv
Prion	Input validation	17 May 202220:15	–	prion

NVD

Node

fidelissecurity deceptionRange<9.4.5

fidelissecurity networkRange<9.4.5

[
  {
    "platforms": [
      "CentOS"
    ],
    "product": "Fidelis Network",
    "vendor": "Fidelis Cybersecurity",
    "versions": [
      {
        "lessThan": "9.4.5",
        "status": "affected",
        "version": "Fidelis Network",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "CentOS"
    ],
    "product": "Fidelis Deception",
    "vendor": "Fidelis Cybersecurity",
    "versions": [
      {
        "lessThan": "9.4.5",
        "status": "affected",
        "version": "Fidelis Deception",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
fidelissecurity	www.fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411

Parameter	Position	Path	Description	CWE
/FSS/bin/shutdown.pl	path	/FSS/bin/shutdown.pl	Misconfigured ownership/permissions allow fidelis user to escalate privileges using shutdown.pl with root privileges via sudoers.	CWE-276
/FSS/setup/cert_mgmt	path	/FSS/setup/cert_mgmt	Misconfigured ownership/permissions on cert_mgmt enable privilege escalation to root via sudoers.	CWE-276
/FSS/bin/db_updater	path	/FSS/bin/db_updater	Misconfigured ownership/permissions on db_updater enable privilege escalation to root via sudoers.	CWE-276
/FSS/deception-manager/bin/deception-manager	path	/FSS/deception-manager/bin/deception-manager	Misconfigured ownership/permissions on deception-manager enable privilege escalation to root via sudoers.	CWE-276
/FSS/sbin/fssdbg.sh	path	/FSS/sbin/fssdbg.sh	Misconfigured ownership/permissions on fssdbg.sh enable privilege escalation to root via sudoers.	CWE-276
/FSS/bin/mst	path	/FSS/bin/mst	Misconfigured ownership/permissions on mst enable privilege escalation to root via sudoers.	CWE-276
/FSS/bin/setup	path	/FSS/bin/setup	Misconfigured ownership/permissions on setup enable privilege escalation to root via sudoers.	CWE-276
/FSS/setup/unlock_cp_user.sh	path	/FSS/setup/unlock_cp_user.sh	Misconfigured ownership/permissions on unlock_cp_user.sh enable privilege escalation to root via sudoers.	CWE-276