title: User Credentials Stored in a Recoverable Format within Fidelis Network and Deception
description: User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.3. This vulnerability has been addressed in version 9.3.3 and subsequent versions.
problem types: CWE-257 Storing Passwords in a Recoverable Format
affected:
{
platforms: CentOS
product: Fidelis Network
vendor: Fidelis Cybersecurity
versions:
lessThan: 9.3.3, status: affected, version: Fidelis Network, versionType: custom
}
{
platforms: CentOS
product: Fidelis Deception
vendor: Fidelis Cybersecurity
versions:
lessThan: 9.3.3, status: affected, version: Fidelis Deception, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
exploits: Command Injection
solutions: Upgrade to version 9.3.7 or version 9.4.1.
Or apply patches to version 9.3.6 or version 9.4.