Riskcovery

CVE-2021-35048

Unauthenticated SQL Injection Vulnerability in Fidelis Network and Deception

State
Published
Severity
9.8 Critical
Published
Jun 25, 2021
Updated
Sep 17, 2024
Reserved
Jun 18, 2021

Read the record on cve.org

Description

Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerability could lead to exposure of authentication tokens in some versions of Fidelis software. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HFidelis

Weaknesses

Affected Products

ProductVersions
Fidelis NetworkFidelis Cybersecurity
  • Fidelis Network 9.4Affected
  • Fidelis Network to before 9.3.7Affected
Fidelis DeceptionFidelis Cybersecurity
  • Fidelis Deception 9.4Affected
  • Fidelis Deception to before 9.3.7Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.