PT-2022-18862 · Brocade · Brocade Sannav

Published 2022-05-06 · Updated 2022-05-13 · CVE-2022-28163

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 2.2.0

Description The issue allows an attacker to run arbitrary SQL commands due to SQL injection susceptibility in multiple endpoints associated with Zone management.

Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Zone management endpoints to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-28163

Affected Products

Brocade Sannav

References · 5

• https://osv.dev/vulnerability/CVE-2022-28163 · Vendor Advisory
• https://broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1842 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28163 · Security Note
• https://t.me/cvenotify/29800 · Telegram Post
• https://t.me/cibsecurity/42122 · Telegram Post