by Kastro
Paper/Archive/CVE-2021-35048

CVE-2021-35048

Fidelis Cybersecurity Fidelis Network — Unauthenticated SQL Injection Vulnerability in Fidelis Network and Deception

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 70.3.703 × 2014.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerability could lead to exposure of authentication tokens in some versions of Fidelis software. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.

Affected

ProductAffectedFixed inSource
Fidelis NetworkFidelis Network 9.4–CNA
Fidelis NetworkFidelis Network – < 9.3.79.3.7CNA
Fidelis DeceptionFidelis Deception 9.4–CNA
Fidelis DeceptionFidelis Deception – < 9.3.79.3.7CNA

Scores by source

Fidelis (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsupport.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-Policiesrefsecurifera.com/blog/2021/06/24/operation-eagle-eye