Lucene search

FidelisCVELIST:CVE-2021-35047

HistoryJun 25, 2021 - 11:44 a.m.

CVE-2021-35047 Privileged Command Injection Vulnerability in Fidelis Network and Deception

2021-06-2511:44:30

CWE-78

Fidelis

www.cve.org

security vulnerability

command injection

fidelis network

deception

patches

updates

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.006

Percentile

79.1%

JSON

Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level access to the CLI to inject root level commands into the component and neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.

CNA Affected

[
  {
    "platforms": [
      "CentOS"
    ],
    "product": "Fidelis Network",
    "vendor": "Fidelis Cybersecurity",
    "versions": [
      {
        "status": "affected",
        "version": "Fidelis Network 9.4"
      },
      {
        "lessThan": "9.3.7",
        "status": "affected",
        "version": "Fidelis Network",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "CentOS"
    ],
    "product": "Fidelis Deception",
    "vendor": "Fidelis Cybersecurity",
    "versions": [
      {
        "status": "affected",
        "version": "Fidelis Deception 9.4"
      },
      {
        "lessThan": "9.3.7",
        "status": "affected",
        "version": "Fidelis Deception",
        "versionType": "custom"
      }
    ]
  }
]

References

support.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-Policies

www.securifera.com/blog/2021/06/24/operation-eagle-eye/

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.006

Percentile

79.1%

JSON

Related for CVELIST:CVE-2021-35047