PT-2022-18864 · Brocade · Brocade Sannav

Published 2022-05-06 · Updated 2023-08-08 · CVE-2022-28165

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Brocade SANNav versions prior to 2.2.0

Description A vulnerability in the role-based access control (RBAC) functionality could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actions that they should not be able to perform. The issue exists because restrictions are not performed on the server side to ensure the user has required permission before processing requests.

Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider implementing additional access controls on the server side to restrict unauthorized access to resources.

Fix

Related Identifiers

CVE-2022-28165

Affected Products

Brocade Sannav

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-28165 · Security Note
• https://broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1844 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28165 · Vendor Advisory
• https://t.me/cibsecurity/42134 · Telegram Post