CVE-2022-24389

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: May 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-24397.2The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted i CVE-2022-243908.8Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user level commands into Fidelis CVE-2022-243918.8Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level ac CVE-2022-243928.8Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feed CVE-2022-243938.8Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “chec CVE-2022-243948.8Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “upda CVE-2022-243956.1SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, re CVE-2022-243967.8The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be a CVE-2022-243976.1SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflect CVE-2022-243986.5Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access CVE-2022-243996.1The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file using CVE-2022-24407.2The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up to