CVE-2023-3489

Summary

The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade from Fabric OS v9.2.0 to any earlier version of Fabric OS.

Affected Software

Weaknesses

• CWE-312: CWE-312 Cleartext Storage of Sensitive Information

Workarounds

The workaround is to use the web interface, REST API or to run the “firmwaredownload “ command in interactive mode.

ADP Enrichment

CVE Program Container

Additional References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22510
• https://security.netapp.com/advisory/ntap-20231124-0003/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22510
• https://security.netapp.com/advisory/ntap-20231124-0003/

• ←Previous
• Next→