CVE-2022-24388

· HIGHModified

← All CVEs

CVSS v3.1

8.8

EPSS

1.47%

Published

May 17, 2022

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78CWE-77

Affected Products (2)

fidelissecurity · deception (up to 9.4.5)vulnerable

fidelissecurity · network (up to 9.4.5)vulnerable

References (2)

https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411

Permissions RequiredVendor Advisory

https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411

Permissions RequiredVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs