CVE-2024-29954 Vulnerability Details

  /     /     /  

CVE-2024-29954 Metadata Quick Info

CVE Published: 25/06/2024 | CVE Updated: 22/08/2024 | CVE Year: 2024
Source: brocade | Vendor: Brocade | Product: Fabric OS
Status : PUBLISHED

---

CVE-2024-29954 Description

A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for protocols such as scp and sftp. Detail. When the firmwaredownload command is incorrectly entered or points to an erroneous file, the firmware download log captures the failed command, including any password entered in the command line.

Metrics

CVSS Version: 3.1 | Base Score: 5.9 MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)* LOCAL
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* LOW
    User Interaction (UI)* REQUIRED
    Scope (S)* CHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* NONE
    Availability Impact (A)* NONE

Weakness Enumeration (CWE)

CWE-ID: CWE-312
CWE Name: CWE-312 Cleartext Storage of Sensitive Information
Source: Brocade

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-37
CAPEC Description: CAPEC-37 Retrieve Embedded Sensitive Data


Source: NVD (National Vulnerability Database).