PT-2023-25047 · Brocade · Brocade Fabric Os

CVE-2023-3489 · Publicado 2023-08-30 · Atualizado 2023-11-24

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS version 9.2.0 Brocade Fabric OS versions prior to 9.2.0

Description The firmwaredownload command on Brocade Fabric OS could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade from Fabric OS v9.2.0 to any earlier version of Fabric OS.

Recommendations For Brocade Fabric OS version 9.2.0, consider disabling the firmwaredownload command until a patch is available to prevent the logging of FTP/SFTP/SCP server passwords in clear text. For Brocade Fabric OS versions prior to 9.2.0, avoid using the firmwaredownload command for downgrades until a fix is provided to prevent password exposure.

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

CVE-2023-3489

Produtos afetados

Brocade Fabric Os

Referências · 6

• https://security.netapp.com/advisory/ntap-20231124-0003 · Nota
• https://t.me/cibsecurity/69506 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-3489 · Aviso do Fabricante
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22510 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-3489 · Nota de Segurança
• https://t.me/cvenotify/61079 · Publicação no Telegram