CVE-2024-29968highCWE-922

CVE-2024-29968: fallo de gravedad alta en Brocade SANnav

SQL Table names, column names, and SQL queries are collected in DR standby Supportsave

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear SANnav

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.7epss 0.5%
An information disclosure vulnerability exists in Brocade SANnav before v2.3.1 and v2.3.0a when Brocade SANnav instances are configured in disaster recovery mode. SQL Table names, column names, and SQL queries are collected in DR standby Supportsave. This could allow authenticated users to access the database structure and its contents.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Productos afectados
Brocade · Brocade SANnav
CVEs relacionadas — Brocade SANnav

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-2859MEDIUMBy default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859)EPSS 0.8%CVE-2024-29961HIGHsupply-chain attack riskEPSS 0.8%CVE-2024-29966HIGHhard-coded credentials in the documentation that appear as the appliance root passwordEPSS 0.7%CVE-2024-4173HIGHSANnav versions exposes Kafka in the wan interface.EPSS 0.6%CVE-2024-29964MEDIUMBrocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker filesEPSS 0.5%CVE-2024-4159MEDIUMProtection mechanismsEPSS 0.5%