Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

password management API prints sensitive information in log files (Brocade Fabric OS)

CVE-2024-29954
MEDIUM 5.9

En bref

Source
NVD
EPSS
EPSS 0.11 % · centile 1 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
brocade
Statut NVD
Modified

Rechercher sur…

Description

A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for protocols such as scp and sftp. Detail. When the firmwaredownload command is incorrectly entered or points to an erroneous file, the firmware download log captures the failed command, including any password entered in the command line.

Faiblesses (CWE)

  • CWE-312 — Stockage en clair d'informations sensibles
  • CWE-532 — Informations sensibles insérées dans un fichier de journal

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 5.9CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:Nbrocade
CVSS 3.1MEDIUM 5.9CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:NNVD · sirt@brocade.com (Secondary)
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NNVD · nvd@nist.gov (Primary)

Références européennes

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Brocade · Fabric OSaffected before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD