CVE-2024-29966

Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The vulnerability could allow an unauthenticated attacker full access to the Brocade SANnav appliance.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.broadcom.com/external/content/SecurityAdvisories/0/23255

Configurations

No configuration.

History

No history.

Information

Published : 2024-04-19 05:15

Updated : 2024-04-19 13:10

NVD link : CVE-2024-29966

Mitre link : CVE-2024-29966

CVE.ORG link : CVE-2024-29966

JSON object : View

Products Affected

No product.

CWE

CWE-798

Use of Hard-coded Credentials

Show plain JSON

{"id": "CVE-2024-29966", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "sirt@brocade.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-04-19T05:15:49.567", "references": [{"url": "https://support.broadcom.com/external/content/SecurityAdvisories/0/23255", "source": "sirt@brocade.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "sirt@brocade.com", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The vulnerability could allow an unauthenticated attacker full access to the Brocade SANnav appliance.\n\n"}, {"lang": "es", "value": "Brocade SANnav OVA anterior a v2.3.1 y v2.3.0a contiene credenciales codificadas en la documentaci\u00f3n que aparecen como la contrase\u00f1a ra\u00edz del dispositivo. La vulnerabilidad podr\u00eda permitir a un atacante no autenticado acceso completo al dispositivo Brocade SANnav."}], "lastModified": "2024-04-19T13:10:25.637", "sourceIdentifier": "sirt@brocade.com"}

{

id : CVE-2024-29966 (string)

cveTags : [ *empty* ]

metrics : { »

cvssMetricV31 : [ »

0 : { »

type : Secondary (string)

source : sirt@brocade.com (string)

cvssData : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.5 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

impactScore : 3.6 (number)

exploitabilityScore : 3.9 (number)

}

]

}

published : 2024-04-19T05:15:49.567 (string)

references : [ »

0 : { »

url : https://support.broadcom.com/external/content/SecurityAdvisories/0/23255 (string)

source : sirt@brocade.com (string)

}

]

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

type : Secondary (string)

source : sirt@brocade.com (string)

description : [ »

0 : { »

lang : en (string)

value : CWE-798 (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The vulnerability could allow an unauthenticated attacker full access to the Brocade SANnav appliance. (string)

}

1 : { »

lang : es (string)

value : Brocade SANnav OVA anterior a v2.3.1 y v2.3.0a contiene credenciales codificadas en la documentación que aparecen como la contraseña raíz del dispositivo. La vulnerabilidad podría permitir a un atacante no autenticado acceso completo al dispositivo Brocade SANnav. (string)

}

]

lastModified : 2024-04-19T13:10:25.637 (string)

sourceIdentifier : sirt@brocade.com (string)

}

CVE-2024-29966

7.5 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

JSON object

Attach tags to CVE-2024-29966

7.5^/10

Attach tags to `CVE-2024-29966`