{
  "id": "CVE-2022-24391",
  "sourceIdentifier": "security@fidelissecurity.com",
  "published": "2022-05-17T20:15:08.453",
  "lastModified": "2024-11-21T06:50:19.377",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level access. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en Fidelis Network y Deception CommandPost permite una inyecci\u00f3n SQL mediante la interfaz web por parte de un atacante con acceso a nivel de usuario. La vulnerabilidad est\u00e1 presente en Fidelis Network y Deception versiones anteriores a 9.4.5. Se presentan parches y actualizaciones disponibles para abordar esta vulnerabilidad"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "security@fidelissecurity.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      },
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "SINGLE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL"
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "security@fidelissecurity.com",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fidelissecurity:deception:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "9.4.5",
              "matchCriteriaId": "B47023FD-5C7C-4A2C-BFF7-7800FB6A33FF"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fidelissecurity:network:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "9.4.5",
              "matchCriteriaId": "3AF6ED2D-5AB3-4D21-AF34-9F0F517C46DD"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411",
      "source": "security@fidelissecurity.com",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ]
    }
  ]
}