PT-2024-4304 · Brocade · Brocade Sannav

Published 2024-04-17 · Updated 2025-02-04 · CVE-2024-29958

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 2.3.1 Brocade SANnav version 2.3.0a

Description The issue is related to insufficient protection of registration data, which could allow a remote attacker to gain unauthorized access to protected information. A vulnerability in Brocade SANnav prints the encryption key in the console when a privileged user executes the script to replace the Brocade SANnav Management Portal standby node, providing attackers an additional path to acquiring the encryption key.

Recommendations For Brocade SANnav versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue. For Brocade SANnav version 2.3.0a, update to version 2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the console output when executing the script to replace the Brocade SANnav Management Portal standby node.

Fix

Information Disclosure

Insertion into Log File

Weakness Enumeration

CWE-200

CWE-532

Related Identifiers

BDU:2024-04791

CVE-2024-29958

Affected Products

Brocade Sannav

References · 9

• https://bdu.fstec.ru/vul/2024-04791 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29958 · Vendor Advisory
• https://safe-surf.ru/upload/VULN-new/VULN.2024-04-26.1.pdf · Security Note
• https://support.broadcom.com/external/content/SecurityAdvisories/0/23242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29958 · Security Note
• https://cybersecurity-help.cz/vdb/SB2024042321 · Note
• https://t.me/cvenotify/77390 · Telegram Post
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23242 · Note
• https://t.me/cvenotify/109862 · Telegram Post