Skip to content
OpenAdvisories
Medium WID-SEC-2023-1937 9 CVEs

Broadcom Brocade Switch: Mehrere Schwachstellen

Published Aug 1, 2023 · Updated May 1, 2024 · Revision 3 · de-DE

Vendor: Broadcom Vendor: HPE Product: Brocade Switch Product: Fabric OS Product: Switch

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in Broadcom Brocade Switch ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren, ein Cross-Site-Scripting-Angriff durchzuführen oder Informationen offenzulegen.

Product

Brocade Switche sind Fibrechannel Switche für Cloud-Speicherumgebungen.

Vulnerabilities 9

  • High 7.8
    CVE-2023-31427

    Knowledge of full path name

    Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path names inside Brocade Fabric OS to execute any command regardless of assigned privilege. Starting with Fabric OS v9.1.0…

    Brocade Fabric OS
  • High 7.8
    CVE-2023-31432

    Privilege issues in multiple commands

    Through manipulation of passwords or other variables, using commands such as portcfgupload, configupload, license, myid, a non-privileged user could obtain root privileges in Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c and v9.2.0.

    Brocade Fabric OS
  • High 7.1
    CVE-2023-31926

    Arbitrary File Overwrite using less command

    System files could be overwritten using the less command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0.

    Brocade Fabric OS
  • Medium 6.3
    CVE-2023-31928

    XSS vulnerability in Brocade Webtools

    A reflected cross-site scripting (XSS) vulnerability exists in Brocade Webtools PortSetting.html of Brocade Fabric OS version before Brocade Fabric OS v9.2.0 that could allow a remote unauthenticated attacker to execute arbitrary JavaScript code in a target u…

    Brocade Fabric OS
  • Medium 5.5
    CVE-2023-31428

    CLI allows upload or transfer files of dangerous types

    Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dump files under user's home directory using grep.

    Brocade Fabric OS
  • Medium 5.5
    CVE-2023-31429

    Multiple commands print sensitive information in the terminal

    Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “reboot”, “rasman”, errmoduleshow, errfilterset, hassiscfgperrthreshold, supportshowcfgdisable and supportshowcfgenable …

    Brocade Fabric OS
  • Medium 5.5
    CVE-2023-31430

    buffer overflow vulnerability in “secpolicydelete” command

    A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0 could allow an authenticated privileged user to crash the Brocade Fabric OS switch leading to a denial of service.

    Brocade Brocade Fabric OS
  • Medium 5.5
    CVE-2023-31431

    A buffer overflow vulnerability in “diagstatus” command

    A buffer overflow vulnerability in “diagstatus” command in Brocade Fabric OS before Brocade Fabric v9.2.0 and v9.1.1c could allow an authenticated user to crash the Brocade Fabric OS switch leading to a denial of service.

    Brocade Fabric OS
  • Medium 5.3
    CVE-2023-31927

    An information disclosure in the web interface of Brocade Fabric OS

    An information disclosure in the web interface of Brocade Fabric OS versions before Brocade Fabric OS v9.2.0 and v9.1.1c, could allow a remote unauthenticated attacker to get technical details about the web interface.

    Brocade Fabric OS

Revision history

  1. #3

    Neue Updates aufgenommen

  2. #2

    Neue Updates von HP aufgenommen

  3. #1

    Initiale Fassung

References