CVE-2024-29968

CWE-922 CWE-200 — Information Exposure3 documents3 sources

Severity

6.5MEDIUM

EPSS

0.3%

top 47.30%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Broadcom Brocade Sannav Brocade Brocade Sannav

Timeline

PublishedApr 19

Description

An information disclosure vulnerability exists in Brocade SANnav before v2.3.1 and v2.3.0a when Brocade SANnav instances are configured in disaster recovery mode. SQL Table names, column names, and SQL queries are collected in DR standby Supportsave. This could allow authenticated users to access the database structure and its contents.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NExploitability: 3.1 | Impact: 4.0

Affected Packages2 packages

▶NVDbroadcom/brocade_sannav< 2.3.0a

▶CVEListV5brocade/brocade_sannavbefore v2.3.1 and v2.3.0a

🔴Vulnerability Details

CVEList

SQL Table names, column names, and SQL queries are collected in DR standby Supportsave↗2024-04-19

▶

GHSA

GHSA-rgqw-g866-w59h: An information disclosure vulnerability exists in Brocade SANnav before v2↗2024-04-19

▶