CVE-2024-29952
published 2024-04-17CVE-2024-29952: A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allow an authenticated user to print the Auth, Priv, and SSL key store passwords in…
PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.11%
1.6th percentile
A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allow an authenticated user to print the Auth, Priv, and SSL key store passwords in unencrypted logs by manipulating command variables.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| broadcom | brocade_sannav | < 2.3.0a | 2.3.0a |
| broadcom | brocade_sannav | < 2.3.1b | 2.3.1b |
| brocade | brocade_sannav | — | — |
| brocade | brocade_sannav | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gq57-6x2p-wrx3: CalInvocationHandler in Brocade
SANnav before 2
ghsa_unreviewed·2025-02-14·CVSS 5.5
CVE-2024-10404 [MEDIUM] CWE-312 GHSA-gq57-6x2p-wrx3: CalInvocationHandler in Brocade
SANnav before 2
CalInvocationHandler in Brocade
SANnav before 2.3.1b logs sensitive information in clear text. The
vulnerability could allow an authenticated, local attacker to view
Brocade Fabric OS switch sensitive information in clear text. An
attacker with administrative privileges could retrieve sensitive
information including passwords; SNMP responses that contain AuthSecret
and PrivSecret after collecting a “supportsave” or getting access to an
already collected “supportsave”. NOTE: this issue exists because of an incomplete fix for CVE-2024-29952
GHSA
GHSA-xrr4-j32g-hj8m: A vulnerability in Brocade SANnav before v2
ghsa_unreviewed·2024-04-18
CVE-2024-29952 [MEDIUM] CWE-312 GHSA-xrr4-j32g-hj8m: A vulnerability in Brocade SANnav before v2
A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a could allow an authenticated user to print the Auth, Priv, and SSL key store passwords in unencrypted logs by manipulating command variables.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-04-17
Published