cnvd - cnvd-2017-00703

CNVD-2017-00703

Vulnerability from cnvd - Published: 2017-01-23

Title

Brocade Network Advisor目录遍历漏洞

Description

Brocade Network Advisor是美国博科通讯系统（Brocade）公司的一套适用于整个网络生命周期中的管理工具。 Brocade Network Advisor 14.0.2及之前的版本中的CliMonitorReportServlet存在目录遍历漏洞。远程攻击者可利用该漏洞读取任意包含敏感用户信息的文件。

Severity

高

Patch Name

Brocade Network Advisor目录遍历漏洞的补丁

Patch Description

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，详情请关注厂商主页： https://www.brocade.com/

Reference

https://www.brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2016-180.htm

Impacted products

Name
Brocade Network Advisor <=14.0.2

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-8207",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8207"
    }
  },
  "description": "Brocade Network Advisor\u662f\u7f8e\u56fd\u535a\u79d1\u901a\u8baf\u7cfb\u7edf\uff08Brocade\uff09\u516c\u53f8\u7684\u4e00\u5957\u9002\u7528\u4e8e\u6574\u4e2a\u7f51\u7edc\u751f\u547d\u5468\u671f\u4e2d\u7684\u7ba1\u7406\u5de5\u5177\u3002\r\n\r\nBrocade Network Advisor 14.0.2\u53ca\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u7684CliMonitorReportServlet\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bfb\u53d6\u4efb\u610f\u5305\u542b\u654f\u611f\u7528\u6237\u4fe1\u606f\u7684\u6587\u4ef6\u3002",
  "discovererName": "rgod working with Trend Micro\u0027s Zero Day Initiative",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttps://www.brocade.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-00703",
  "openTime": "2017-01-23",
  "patchDescription": "Brocade Network Advisor\u662f\u7f8e\u56fd\u535a\u79d1\u901a\u8baf\u7cfb\u7edf\uff08Brocade\uff09\u516c\u53f8\u7684\u4e00\u5957\u9002\u7528\u4e8e\u6574\u4e2a\u7f51\u7edc\u751f\u547d\u5468\u671f\u4e2d\u7684\u7ba1\u7406\u5de5\u5177\u3002\r\n\r\nBrocade Network Advisor 14.0.2\u53ca\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u7684CliMonitorReportServlet\u5b58\u5728\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bfb\u53d6\u4efb\u610f\u5305\u542b\u654f\u611f\u7528\u6237\u4fe1\u606f\u7684\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Brocade Network Advisor\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Brocade Network Advisor \u003c=14.0.2"
  },
  "referenceLink": "https://www.brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2016-180.htm",
  "serverity": "\u9ad8",
  "submitTime": "2017-01-16",
  "title": "Brocade Network Advisor\u76ee\u5f55\u904d\u5386\u6f0f\u6d1e"
}

CVE-2016-8207 (GCVE-0-2016-8207)

Vulnerability from cvelistv5 – Published: 2017-01-14 19:00 – Updated: 2024-08-06 02:13

Summary

A Directory Traversal vulnerability in CliMonitorReportServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to read arbitrary files including files with sensitive user information.

Severity ?

No CVSS data available.

CWE

Directory Traversal

Assigner

brocade

References

URL

Tags

	http://www.securityfocus.com/bid/95691	vdb-entryx_refsource_BID
	http://www.zerodayinitiative.com/advisories/ZDI-17-052	x_refsource_MISC
	https://support.hpe.com/hpsc/doc/public/display?d…	x_refsource_CONFIRM
	https://www.broadcom.com/support/fibre-channel-ne…	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	Brocade Network Advisor versions released prior to and including 14.0.2	Affected: Brocade Network Advisor versions released prior to and including 14.0.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:13:21.815Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "95691",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95691"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.zerodayinitiative.com/advisories/ZDI-17-052"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03785en_us"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-180"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Brocade Network Advisor versions released prior to and including 14.0.2",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Brocade Network Advisor versions released prior to and including 14.0.2"
            }
          ]
        }
      ],
      "datePublic": "2017-01-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Directory Traversal vulnerability in CliMonitorReportServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to read arbitrary files including files with sensitive user information."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Directory Traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-05-09T09:57:01",
        "orgId": "87b297d7-335e-4844-9551-11b97995a791",
        "shortName": "brocade"
      },
      "references": [
        {
          "name": "95691",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95691"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.zerodayinitiative.com/advisories/ZDI-17-052"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03785en_us"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-180"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "sirt@brocade.com",
          "ID": "CVE-2016-8207",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Brocade Network Advisor versions released prior to and including 14.0.2",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Brocade Network Advisor versions released prior to and including 14.0.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Directory Traversal vulnerability in CliMonitorReportServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to read arbitrary files including files with sensitive user information."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Directory Traversal"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "95691",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/95691"
            },
            {
              "name": "http://www.zerodayinitiative.com/advisories/ZDI-17-052",
              "refsource": "MISC",
              "url": "http://www.zerodayinitiative.com/advisories/ZDI-17-052"
            },
            {
              "name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03785en_us",
              "refsource": "CONFIRM",
              "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03785en_us"
            },
            {
              "name": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-180",
              "refsource": "CONFIRM",
              "url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-180"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "87b297d7-335e-4844-9551-11b97995a791",
    "assignerShortName": "brocade",
    "cveId": "CVE-2016-8207",
    "datePublished": "2017-01-14T19:00:00",
    "dateReserved": "2016-09-13T00:00:00",
    "dateUpdated": "2024-08-06T02:13:21.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-00703

CVE-2016-8207 (GCVE-0-2016-8207)

Tags

Sightings

Nomenclature