PT-2022-16666 · Fidelis · Fidelis Network/Deception

Published 2022-05-17 · Updated 2022-05-26 · CVE-2022-24391

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fidelis Network and Deception versions prior to 9.4.5

Description The issue allows SQL injection through the web interface by an attacker with user level access. Patches and updates are available to address this issue.

Recommendations For versions prior to 9.4.5, update to version 9.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-24391

Affected Products

Fidelis Network/Deception

References · 4

• https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24391 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24391 · Vendor Advisory
• https://t.me/cvenotify/30758 · Telegram Post