Skip to content
OpenAdvisories
Medium WID-SEC-2024-0934 6 CVEs

Broadcom Brocade SANnav: Mehrere Schwachstellen

Published Apr 18, 2024 · Updated Oct 14, 2024 · Revision 2 · de-DE

Vendor: Broadcom Product: Brocade SANnav

Summary

Ein Angreifer kann mehrere Schwachstellen in Broadcom Brocade SANnav ausnutzen, um Dateien zu manipulieren oder vertrauliche Informationen offenzulegen.

Product

Brocade SANnav ist eine Managementlösung für Storage Area Networks (SAN).

Vulnerabilities 6

  • High 7.5
    CVE-2024-29957

    Encryption key is stored in the DR log files

    When Brocade SANnav before v2.3.1 and v2.3.0a servers are configured in Disaster Recovery mode, the encryption key is stored in the DR log files. This could provide attackers with an additional, less-protected path to acquiring the encryption key.

    Brocade Brocade SANnav
  • High 7.5
    CVE-2024-29966

    hard-coded credentials in the documentation that appear as the appliance root password

    Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The vulnerability could allow an unauthenticated attacker full access to the Brocade SANnav appliance.

    Brocade Brocade SANnav
  • Medium 6.8
    CVE-2024-29965

    Insecure backup

    In Brocade SANnav before v2.3.1, and v2.3.0a, it is possible to back up the appliance from the web interface or the command line interface ("SSH"). The resulting backups are world-readable. A local attacker can recover backup files, restore them to a new mali…

    Brocade Brocade SANnav
  • Medium 5.7
    CVE-2024-29964

    Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files

    Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. An unprivileged attacker who gains access to the server can read sensitive information from these files.

    Brocade Brocade SANnav
  • Medium 5.5
    CVE-2024-29962

    Insecure file permission setting that makes files world-readable

    Brocade SANnav OVA before v2.3.1 and v2.3.0a have an insecure file permission setting that makes files world-readable. This could allow a local user without the required privileges to access sensitive information or a Java binary.

    Brocade Brocade SANnav
  • Medium 4.4
    CVE-2024-29967

    In Brocade SANnav before v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points

    In Brocade SANnav before Brocade SANnav v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points, allowing reading and writing access to sensitive files. The vulnerability could allow a sudo privileged user on t…

    Brocade Brocade SANnav

Revision history

  1. #2

    Neue Updates aufgenommen

  2. #1

    Initiale Fassung

References