CVE-2024-2859

CWE-276 — Incorrect Default Permissions CWE-269 — Improper Privilege Management3 documents3 sources

Severity

7.2HIGH

EPSS

1.5%

top 18.86%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Broadcom Brocade Sannav Brocade Brocade Sannav

Timeline

PublishedApr 27

Description

By default, SANnav OVA is shipped with root user login enabled. While protected by a password, access to root could expose SANnav to a remote attacker should they gain access to the root account.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.9 | Impact: 5.9

Affected Packages2 packages

▶NVDbroadcom/brocade_sannav< 2.3.0

▶CVEListV5brocade/brocade_sannavv2.3.0

🔴Vulnerability Details

GHSA

GHSA-46wg-cm84-p5p3: By default, SANnav OVA is shipped with root user login enabled↗2024-04-27

▶

CVEList

By default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859)↗2024-04-27

▶