CVE-2022-33187mediumCWE-532

CVE-2022-33187: medium-severity vulnerability in Brocade SANnav

Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs

Published · Updated

Follow this CVE+ Monitor SANnav

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.5epss 0.5%
Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Affected products
Brocade · Brocade SANnav
Related CVEs — Brocade SANnav

In the same product, most dangerous first.

CVE-2024-2859MEDIUMBy default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859)EPSS 0.8%CVE-2024-29961HIGHsupply-chain attack riskEPSS 0.8%CVE-2024-29966HIGHhard-coded credentials in the documentation that appear as the appliance root passwordEPSS 0.7%CVE-2024-4173HIGHSANnav versions exposes Kafka in the wan interface.EPSS 0.6%CVE-2024-29964MEDIUMBrocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker filesEPSS 0.5%CVE-2024-4159MEDIUMProtection mechanismsEPSS 0.5%