CVE-2021-35048
CRITICALFidelis Network & Deception <9.3.7, 9.4 - SQL Injection
Title source: llmDescription
Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerability could lead to exposure of authentication tokens in some versions of Fidelis software. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.
References (2)
Core 2
Core References
Permissions Required, Vendor Advisory x_refsource_confirm
https://support.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-Policies
Exploit, Third Party Advisory x_refsource_misc
https://www.securifera.com/blog/2021/06/24/operation-eagle-eye/
Scores
CVSS v3
9.8
EPSS
0.0129
EPSS Percentile
67.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (4)
fidelissecurity/deception
9.4
fidelissecurity/deception
< 9.3.7
fidelissecurity/network
9.4
fidelissecurity/network
< 9.3.7
Published
Jun 25, 2021
Tracked Since
Feb 18, 2026