Login Request a demo
Medium severity · published Aug 31, 2023
CVE-2023-31423
Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav before v2.3.0 and…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav before v2.3.0 and 2.2.2a. Notes: To access the logs, the local attacker must have access to an already collected Brocade SANnav "supportsave" outputs.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
Brocade Sannav · Broadcom
before 2.2.2a · source: NVD
Affected product
BS
Brocade Sannav
Broadcom
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-31423
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-31423
security.netapp.com
https://security.netapp.com/advisory/ntap-20240229-0003/
Vendor Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/22508
More from Brocade Sannav
9.8
CVE-2024-4282
Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22
9.8
CVE-2024-4173
A vulnerability in Brocade SANnav exposes Kafka in the wan interface
9.8
CVE-2024-29966
Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password
9.8
CVE-2023-31424
Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout