PT-2024-7964 · Brocade · Brocade Sannav

Pierre Barre · Published 2024-04-17 · Updated 2025-02-04 · CVE-2024-29965

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 2.3.1 Brocade SANnav version 2.3.0a

Description The issue is related to the backup function in Brocade SANnav, which stores confidential information insecurely. This allows a local attacker to recover backup files, restore them to a new malicious appliance, and retrieve the passwords of all the switches. The backups can be created from the web interface or the command line interface, and the resulting files are world-readable.

Recommendations For Brocade SANnav versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue. For Brocade SANnav version 2.3.0a, update to version 2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the backup function to minimize the risk of exploitation.

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

BDU:2024-09477

CVE-2024-29965

Affected Products

Brocade Sannav

References · 7

• https://osv.dev/vulnerability/CVE-2024-29965 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29965 · Security Note
• https://bdu.fstec.ru/vul/2024-09477 · Security Note
• https://support.broadcom.com/external/content/SecurityAdvisories/0/23250 · Vendor Advisory
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23250 · Note
• https://t.me/cvenotify/77397 · Telegram Post
• https://t.me/cvenotify/109869 · Telegram Post