CVE-2024-29961highCWE-200

CVE-2024-29961: falha de alta gravidade em Brocade SANnav

supply-chain attack risk

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar SANnav

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.8%
A vulnerability affects Brocade SANnav before v2.3.1 and v2.3.0a. It allows a Brocade SANnav service to send ping commands in the background at regular intervals to gridgain.com to check if updates are available for the Component. This could make an unauthenticated, remote attacker aware of the behavior and launch a supply-chain attack against a Brocade SANnav appliance.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Produtos afetados
Brocade · Brocade SANnav
CVEs relacionadas — Brocade SANnav

No mesmo produto, das mais perigosas para as menos.

CVE-2024-2859MEDIUMBy default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859)EPSS 0.8%CVE-2024-29966HIGHhard-coded credentials in the documentation that appear as the appliance root passwordEPSS 0.7%CVE-2024-4173HIGHSANnav versions exposes Kafka in the wan interface.EPSS 0.6%CVE-2024-29964MEDIUMBrocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker filesEPSS 0.5%CVE-2024-4159MEDIUMProtection mechanismsEPSS 0.5%CVE-2024-2240HIGHDocker implementation in Brocade SANnav is missing Audit Rules.EPSS 0.5%