PT-2022-7034 · Brocade · Brocade Fabric Os

Omar Eissa · Published 2022-09-13 · Updated 2023-03-02 · CVE-2022-28169

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to v9.1.1 Brocade Fabric OS versions prior to v9.0.1e Brocade Fabric OS versions prior to v8.2.3c

Description The issue allows a low-privilege webtools user to gain elevated admin rights by exploiting a vulnerability in Brocade Webtools. This can be achieved by intercepting and editing the admin and operator authorization headers, which are sent unencrypted, to create a new user with an admin role using the operator's session ID.

Recommendations For Brocade Fabric OS versions prior to v9.1.1, update to version v9.1.1 or later. For Brocade Fabric OS versions prior to v9.0.1e, update to version v9.0.1e or later. For Brocade Fabric OS versions prior to v8.2.3c, update to version v8.2.3c or later.

Fix

Improper Authorization

Improper Privilege Management

Weakness Enumeration

CWE-285

CWE-269

Related Identifiers

BDU:2023-07195

CVE-2022-28169

Affected Products

Brocade Fabric Os

References · 7

• https://osv.dev/vulnerability/CVE-2022-28169 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28169 · Security Note
• https://broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-2075 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07195 · Security Note
• https://t.me/cibsecurity/52080 · Telegram Post
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21238 · Note
• https://security.netapp.com/advisory/ntap-20230127-0001 · Note