PT-2022-16668 · Fidelis · Fidelis Network/Deception

Published 2022-05-17 · Updated 2022-05-26 · CVE-2022-24393

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fidelis Network and Deception versions prior to 9.4.5

Description The issue allows authenticated command injection through the web interface using the check vertica upgrade value for the cpIp parameter. This could enable a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response via an authenticated session.

Recommendations For versions prior to 9.4.5, update to version 9.4.5 or later to address this issue. As a temporary workaround, consider restricting access to the web interface or limiting the use of the cpIp parameter until a patch is applied.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2022-24393

Affected Products

Fidelis Network/Deception

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-24393 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24393 · Vendor Advisory
• https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411 · Vendor Advisory
• https://t.me/cvenotify/30760 · Telegram Post