CVE-2022-24391

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level access. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 17, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-243928.8Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feedCVE-2022-243938.8Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “checCVE-2022-243948.8Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “updaCVE-2022-243956.1SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, reCVE-2022-243967.8The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be aCVE-2022-243976.1SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflectCVE-2022-243986.5Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to accessCVE-2022-243996.1The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file usingCVE-2022-24407.2The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up toCVE-2022-244005.9A flaw in the TETRA authentication procecure allows a MITM adversary that can predict the MS challenge RAND2 to set session key DCK to zero.CVE-2022-244018.1Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon sCVE-2022-244027.5The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usag