CVE-2024-29968
Assigner: brocade
Published: 2024-04-19T05:17:57.502Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Brocade SANnav
vendor: Brocade
versions: status: affected
version: before v2.3.1 and v2.3.0a 
descriptions: supportingMedia: base64: no
type: text/html
value: An information disclosure vulnerability exists in Brocade SANnav before v2.3.1 and v2.3.0a when Brocade SANnav instances are configured in disaster recovery mode. SQL Table names, column names, and SQL queries are collected in DR standby Supportsave. This could allow authenticated users to access the database structure and its contents.




value: An information disclosure vulnerability exists in Brocade SANnav before v2.3.1 and v2.3.0a when Brocade SANnav instances are configured in disaster recovery mode. SQL Table names, column names, and SQL queries are collected in DR standby Supportsave. This could allow authenticated users to access the database structure and its contents.


impacts: capecId: CAPEC-37
descriptions: value: CAPEC-37 Retrieve Embedded Sensitive Data
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
type: CWE
source: discovery: UNKNOWN
title: SQL Table names, column names, and SQL queries are collected in DR standby Supportsave
x_generator: engine: Vulnogram 0.1.0-dev