CVE-2024-29968

Published Apr 19, 2024

Last updated 20 days ago

Overview

Description: An information disclosure vulnerability exists in Brocade SANnav before v2.3.1 and v2.3.0a when Brocade SANnav instances are configured in disaster recovery mode. SQL Table names, column names, and SQL queries are collected in DR standby Supportsave. This could allow authenticated users to access the database structure and its contents.
Source: sirt@brocade.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

sirt@brocade.com: CWE-922
nvd@nist.gov: CWE-922

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:broadcom:brocade_sannav:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "303EE152-4CED-4655-B035-CB3B91E5E288",
            "versionEndExcluding": "2.3.0a"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References