Description
Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level access. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
References (1)
Core 1
Core References
Permissions Required, Vendor Advisory x_refsource_confirm
https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411
Scores
CVSS v3
8.8
EPSS
0.0090
EPSS Percentile
55.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (2)
fidelissecurity/deception
< 9.4.5
fidelissecurity/network
< 9.4.5
Published
May 17, 2022
Tracked Since
Feb 18, 2026