fkie_cve-2024-10403
Vulnerability from fkie_nvd
Published
2024-11-21 11:15
Modified
2024-11-21 13:57
Severity ?
Summary
Brocade Fabric OS versions before
8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can
capture the SFTP/FTP server password used for a firmware download
operation initiated by SANnav or through WebEM in a weblinker core dump
that is later captured via supportsave.
References
Impacted products
Vendor | Product | Version |
---|
{ cveTags: [], descriptions: [ { lang: "en", value: "Brocade Fabric OS versions before \n8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can \ncapture the SFTP/FTP server password used for a firmware download \noperation initiated by SANnav or through WebEM in a weblinker core dump \nthat is later captured via supportsave.", }, { lang: "es", value: "Las versiones del sistema operativo Brocade Fabric anteriores a 8.2.3e2, las versiones 9.0.0 a 9.2.0c y las versiones 9.2.1 a 9.2.1a pueden capturar la contraseña del servidor SFTP/FTP utilizada para una operación de descarga de firmware iniciada por SANnav o a través de WebEM en un volcado de núcleo de weblinker que luego se captura a través de supportedsave.", }, ], id: "CVE-2024-10403", lastModified: "2024-11-21T13:57:24.187", metrics: { cvssMetricV40: [ { cvssData: { attackComplexity: "LOW", attackRequirements: "PRESENT", attackVector: "ADJACENT", automatable: "NOT_DEFINED", availabilityRequirements: "NOT_DEFINED", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityRequirements: "NOT_DEFINED", exploitMaturity: "NOT_DEFINED", integrityRequirements: "NOT_DEFINED", modifiedAttackComplexity: "NOT_DEFINED", modifiedAttackRequirements: "NOT_DEFINED", modifiedAttackVector: "NOT_DEFINED", modifiedPrivilegesRequired: "NOT_DEFINED", modifiedSubsequentSystemAvailability: "NOT_DEFINED", modifiedSubsequentSystemConfidentiality: "NOT_DEFINED", modifiedSubsequentSystemIntegrity: "NOT_DEFINED", modifiedUserInteraction: "NOT_DEFINED", modifiedVulnerableSystemAvailability: "NOT_DEFINED", modifiedVulnerableSystemConfidentiality: "NOT_DEFINED", modifiedVulnerableSystemIntegrity: "NOT_DEFINED", privilegesRequired: "NONE", providerUrgency: "NOT_DEFINED", recovery: "NOT_DEFINED", safety: "NOT_DEFINED", subsequentSystemAvailability: "NONE", subsequentSystemConfidentiality: "NONE", subsequentSystemIntegrity: "NONE", userInteraction: "PASSIVE", valueDensity: "NOT_DEFINED", vectorString: "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", version: "4.0", vulnerabilityResponseEffort: "NOT_DEFINED", vulnerableSystemAvailability: "NONE", vulnerableSystemConfidentiality: "HIGH", vulnerableSystemIntegrity: "NONE", }, source: "sirt@brocade.com", type: "Secondary", }, ], }, published: "2024-11-21T11:15:16.533", references: [ { source: "sirt@brocade.com", url: "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25145", }, ], sourceIdentifier: "sirt@brocade.com", vulnStatus: "Undergoing Analysis", weaknesses: [ { description: [ { lang: "en", value: "CWE-528", }, ], source: "sirt@brocade.com", type: "Secondary", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.