Insecure backup (Brocade Brocade SANnav)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.41 % · percentile 35 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- brocade
- NVD status
- Analyzed
Description
In Brocade SANnav before v2.3.1, and v2.3.0a, it is possible to back up the appliance from the web interface or the command line interface ("SSH"). The resulting backups are world-readable. A local attacker can recover backup files, restore them to a new malicious appliance, and retrieve the passwords of all the switches.
Weaknesses (CWE)
- CWE-922 — Insecure Storage of Sensitive Information
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N | brocade |
| CVSS 3.1 | MEDIUM 6.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N | NVD · sirt@brocade.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.9 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-26939
- GCVE · GCVE-0-2024-29965
Affected configurations (NVD CPE)
cpe:2.3:a:broadcom:brocade_sannav:*:*:*:*:*:*:*:*< 2.3.0a
Affected products
| Product | Versions |
|---|---|
| Brocade · Brocade SANnav | affected before v2.3.1, and v2.3.0a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |