Riskcovery

CVE-2021-35050

User Credentials Stored in a Recoverable Format within Fidelis Network and Deception

State
Published
Severity
6.5 Medium
Published
Jun 25, 2021
Updated
Sep 16, 2024
Reserved
Jun 18, 2021

Read the record on cve.org

Description

User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.3. This vulnerability has been addressed in version 9.3.3 and subsequent versions.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NFidelis

Weaknesses

  • CWE-257 Storing Passwords in a Recoverable Format

Affected Products

ProductVersions
Fidelis NetworkFidelis Cybersecurity
  • Fidelis Network to before 9.3.3Affected
Fidelis DeceptionFidelis Cybersecurity
  • Fidelis Deception to before 9.3.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.