漏洞标题
Fidelis网络和欺骗中的本地权限升级漏洞
漏洞描述信息
Fidelis Network和Deception中的本地权限提升漏洞
CVSS信息
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
Local Privilege Escalation Vulnerability in Fidelis Network and Deception
漏洞描述信息
Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected script files, which could result in arbitrary commands being run as root upon subsequent logon by a root user. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
CVSS信息
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
漏洞类别
缺省权限不正确
漏洞标题
Fidelis Network Deception 安全漏洞
漏洞描述信息
Fidelis Network Deception是美国Fidelis公司的一款安全产品。用于检测威胁并防止数据丢失，有检测恶意行为、识别流量异常、自动响应高级威胁等功能。 Fidelis Network Deception 9.4.5之前版本存在安全漏洞，该漏洞源于CommandPost、Collector、Sensor 和 Sandbox 组件中的文件权限不正确。具有 CLI 本地管理访问权限的攻击者能够利用该漏洞修改受影响的文件并提升特权运行任意命令。
CVSS信息
N/A
漏洞类别
其他