CVE-2023-31426 — Log File Information Exposure in Fabric Operating System

CWE-532 — Log File Information Exposure3 documents3 sources
Severity
6.5MEDIUMNVD
CNA6.8
EPSS
0.2%
top 63.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Broadcom Fabric Operating SystemBrocade Fabric OS
Timeline
PublishedAug 1
Latest updateAug 2

Description

The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0 print scp, sftp, ftp servers passwords in supportsave. This could allow a remote authenticated attacker to access sensitive information.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5brocade/brocade_fabric_osbefore Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0
▶NVDbroadcom/fabric_operating_system9.0.0 — 9.1.1c+1

🔴Vulnerability Details

2
GHSA
GHSA-g732-pffp-45rc: The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9↗2023-08-02
▶
CVEList
scp, sftp, ftp servers passwords in supportsave↗2023-08-01
▶