PT-2024-7965 · Brocade · Brocade Sannav

Pierre Barre · Published 2024-04-17 · Updated 2024-04-19 · CVE-2024-29967

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 2.31 Brocade SANnav version 2.3.0a and earlier

Description The issue is related to insecure mount points in Docker instances within the appliance, allowing a sudo privileged user on the host OS to access sensitive files. This could enable reading and writing access to these files. The vulnerability is associated with incorrectly used standard permissions.

Recommendations For Brocade SANnav versions prior to 2.31, update to version 2.31 or later to resolve the issue. For Brocade SANnav version 2.3.0a and earlier, update to a version later than 2.3.0a to resolve the issue. As a temporary workaround, consider restricting access to the Docker instances inside the appliance to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2024-09478

CVE-2024-29967

Affected Products

Brocade Sannav

References · 6

• https://support.broadcom.com/external/content/SecurityAdvisories/0/23254 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29967 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09478 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-29967 · Security Note
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23254 · Note
• https://t.me/cvenotify/77399 · Telegram Post