PT-2022-3073 · Brocade · Brocade Fabric Os+1

Published 2022-06-22 · Updated 2023-08-08 · CVE-2022-28167

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 2.2.0.2 Brocade SANnav versions prior to 2.1.1.8

Description The issue is related to the storage of sensitive information in plain text. Specifically, the Brocade Fabric OS switch password is logged in plain text in the asyncjobscheduler-manager.log file. This could allow an attacker to gain elevated privileges.

Recommendations For Brocade SANnav versions prior to 2.2.0.2, update to version 2.2.0.2 or later. For Brocade SANnav versions prior to 2.1.1.8, update to version 2.1.1.8 or later. As a temporary workaround, consider restricting access to the asyncjobscheduler-manager.log file to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-522

CWE-312

Related Identifiers

BDU:2022-03743

CVE-2022-28167

Affected Products

Brocade Fabric Os

Brocade Sannav

References · 8

• https://broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1978 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03743 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-28167 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28167 · Vendor Advisory
• https://t.me/true_secator/3121 · Telegram Post
• https://t.me/cvenotify/32249 · Telegram Post
• https://t.me/cibsecurity/45222 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220627-0002 · Note