Lucene search

Broadcom Security ResponseBSNSA23226

HistoryApr 30, 2024 - 12:00 a.m.

password management API prints sensitive information in log files (CVE-2024-29954)

2024-04-3000:00:00

Broadcom Security Response

support.broadcom.com

vulnerability

password management

api

brocade fabric os

sensitive information

log files

authenticated user

server passwords

scp

sftp

firmware

cve-2024-29954

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for protocols such as scp and sftp.

Detail.
When the firmwaredownload command is incorrectly entered or points to an erroneous file, the firmware download log captures the failed command, including any password entered in the command line.