« Volver al listado

CVE-2022-24389

Estado: ModificadaAlta (8.8)—

Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Fidelissecurity — DeceptionFidelissecurity — Network

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-24389",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@fidelissecurity.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@fidelissecurity.com",
      "affectedData": [
        {
          "vendor": "Fidelis Cybersecurity",
          "product": "Fidelis Network",
          "versions": [
            {
              "status": "affected",
              "version": "Fidelis Network",
              "lessThan": "9.4.5",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "CentOS"
          ]
        },
        {
          "vendor": "Fidelis Cybersecurity",
          "product": "Fidelis Deception",
          "versions": [
            {
              "status": "affected",
              "version": "Fidelis Deception",
              "lessThan": "9.4.5",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "CentOS"
          ]
        }
      ]
    }
  ],
  "published": "2022-05-17T20:15:08.343",
  "references": [
    {
      "url": "https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "security@fidelissecurity.com"
    },
    {
      "url": "https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@fidelissecurity.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en rconfig \"cert_utils\" permite a un atacante con acceso de nivel de usuario a la CLI inyectar comandos de nivel root en los componentes CommandPost, Collector, Sensor y Sandbox de Fidelis Network y Deception, así como en los componentes vecinos de Fidelis. La vulnerabilidad está presente en Fidelis Network y Deception versiones anteriores a 9.4.5. Se presentan parches y actualizaciones disponibles para abordar esta vulnerabilidad"
    }
  ],
  "lastModified": "2026-06-17T04:31:45.023",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fidelissecurity:deception:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B47023FD-5C7C-4A2C-BFF7-7800FB6A33FF",
              "versionEndExcluding": "9.4.5"
            },
            {
              "criteria": "cpe:2.3:a:fidelissecurity:network:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AF6ED2D-5AB3-4D21-AF34-9F0F517C46DD",
              "versionEndExcluding": "9.4.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@fidelissecurity.com"
}