PT-2023-25047 · Brocade · Brocade Fabric Os

Published 2023-08-30 · Updated 2023-11-24 · CVE-2023-3489

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS version 9.2.0 Brocade Fabric OS versions prior to 9.2.0

Description The firmwaredownload command on Brocade Fabric OS could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade from Fabric OS v9.2.0 to any earlier version of Fabric OS.

Recommendations For Brocade Fabric OS version 9.2.0, consider disabling the firmwaredownload command until a patch is available to prevent the logging of FTP/SFTP/SCP server passwords in clear text. For Brocade Fabric OS versions prior to 9.2.0, avoid using the firmwaredownload command for downgrades until a fix is provided to prevent password exposure.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2023-3489

Affected Products

Brocade Fabric Os

References · 6

• https://osv.dev/vulnerability/CVE-2023-3489 · Vendor Advisory
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22510 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3489 · Security Note
• https://security.netapp.com/advisory/ntap-20231124-0003 · Note
• https://t.me/cibsecurity/69506 · Telegram Post
• https://t.me/cvenotify/61079 · Telegram Post