CVE-2021-35048

Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerability could lead to exposure of authentication tokens in some versions of Fidelis software. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.

• CWE-89
• CWE-89

• https://support.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-PoliciesPermissions Required, Vendor Advisory
• https://www.securifera.com/blog/2021/06/24/operation-eagle-eye/Exploit, Third Party Advisory
• https://support.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-PoliciesPermissions Required, Vendor Advisory
• https://www.securifera.com/blog/2021/06/24/operation-eagle-eye/Exploit, Third Party Advisory

Published

Jun 25, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35041The blockchain node in FISCO-BCOS V2.7.2 may have a bug when…7.5
• CVE-2021-35042Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows Que…9.8
• CVE-2021-35043OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes w…6.1
• CVE-2021-35045Cross site scripting (XSS) vulnerability in Ice Hrm 29.0.0.O…6.1
• CVE-2021-35046A session fixation vulnerability was discovered in Ice Hrm 2…6.1
• CVE-2021-35047Vulnerability in the CommandPost, Collector, and Sensor comp…8.8
• CVE-2021-35049Vulnerability in Fidelis Network and Deception CommandPost e…8.8
• CVE-2021-3505A flaw was found in libtpms in versions before 0.8.0. The TP…5.5
• CVE-2021-35050User credentials stored in a recoverable format within Fidel…7.5
• CVE-2021-35052A component in Kaspersky Password Manager could allow an att…7.8
• CVE-2021-35053Possible system denial of service in case of arbitrary chang…7.5
• CVE-2021-35054Minecraft before 1.17.1, when online-mode=false is configure…7.5