CVE-2024-29964: medium-severity vulnerability in Brocade SANnav
Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.7epss 0.5%
Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. An unprivileged attacker who gains access to the server can read sensitive information from these files.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Brocade · Brocade SANnavRelated CVEs — Brocade SANnav
In the same product, most dangerous first.
CVE-2024-2859MEDIUMBy default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859)EPSS 0.8%CVE-2024-29961HIGHsupply-chain attack riskEPSS 0.8%CVE-2024-29966HIGHhard-coded credentials in the documentation that appear as the appliance root passwordEPSS 0.7%CVE-2024-4173HIGHSANnav versions exposes Kafka in the wan interface.EPSS 0.6%CVE-2024-4159MEDIUMProtection mechanismsEPSS 0.5%CVE-2024-2240HIGHDocker implementation in Brocade SANnav is missing Audit Rules.EPSS 0.5%