CVE-2022-0486
Last modified
CVE-2022-0486 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected files and enable escalation of privileges equivalent to the root user. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected files and enable escalation of privileges equivalent to the root user. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Fidelissecurity | Deception | < 9.4.5 |
| Fidelissecurity | Network | < 9.4.5 |
References
- https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411Permissions Required, Vendor Advisory
- https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411Permissions Required, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-0486?
How severe is CVE-2022-0486?
How do I fix CVE-2022-0486?
Are you affected by CVE-2022-0486?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST