Lucene search

[email protected]CVE-2017-6225

HistoryFeb 08, 2018 - 10:29 p.m.

CVE-2017-6225

2018-02-0822:29:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2017-6225

cross-site scripting

xss

brocade

fos

vulnerability

web-based management

remote code execution

sensitive information access

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

66.1%

JSON

Cross-site scripting (XSS) vulnerability in the web-based management interface of Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b, 8.1.2 and 8.2.0 could allow remote attackers to execute arbitrary code or access sensitive browser-based information.

Affected configurations

NVD

Node

broadcomfabric_operating_systemRange<7.4.2b

broadcomfabric_operating_systemMatch8.0.2

broadcomfabric_operating_systemMatch8.1.1

brocadefabric_osMatch8.0.1b1

brocadefabric_osMatch8.0.2b1

brocadefabric_osMatch8.1.0c1

CPENameOperatorVersion
broadcom:fabric_operating_systembroadcom fabric operating systemlt7.4.2b
broadcom:fabric_operating_systembroadcom fabric operating systemeq8.0.2
broadcom:fabric_operating_systembroadcom fabric operating systemeq8.1.1
brocade:fabric_osbrocade fabric oseq8.0.1b1
brocade:fabric_osbrocade fabric oseq8.0.2b1
brocade:fabric_osbrocade fabric oseq8.1.0c1

CPE	Name	Operator	Version
broadcom:fabric_operating_system	broadcom fabric operating system	lt	7.4.2b
broadcom:fabric_operating_system	broadcom fabric operating system	eq	8.0.2
broadcom:fabric_operating_system	broadcom fabric operating system	eq	8.1.1
brocade:fabric_os	brocade fabric os	eq	8.0.1b1
brocade:fabric_os	brocade fabric os	eq	8.0.2b1
brocade:fabric_os	brocade fabric os	eq	8.1.0c1

CNA Affected

[
  {
    "product": "Brocade FABRIC OS",
    "vendor": "Brocade Communications Systems, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "all versions before 7.4.2b, v8.1.2 and 8.2.0"
      }
    ]
  }
]

References

support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03851en_us

www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-525

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.2 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

66.1%

JSON

Related for CVE-2017-6225

prion1 nvd1 cvelist1 ibm2 lenovo2