BSA-2020-1077

Brocade Fabric OS

2 more products

21344

10 May 2021

08 September 2020

Closed

Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - 6.1

Yes

CVE-2018-6449

Summary

Security Advisory ID : BSA-2020-1077

Component : HTTP management interface

Revision : 2.0

Host Header Injection vulnerability in the http management interface in Brocade Fabric OS versions before  v9.0.0, v8.2.3 could allow a remote attacker to exploit this vulnerability by injecting arbitrary HTTP headers, which could allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning, Password reset or session hijacking.

Note: There is no impact on the operation of the switch or to any Fibre Channel traffic.   This exploit only impacts the management access through HTTP.

Affected Products

Brocade Fabric OS versions before v9.0.0, and v8.2.3.

Product Confirmed Not Vulnerable

  • Analysis is in progress for Brocade Fabric OS v7.4.x
  • No other Brocade Fibre Channel Products from Broadcom products are currently known to be affected by this vulnerability.

Solution

A security update has been provided in Brocade Fabric OS versions v9.0.0, and v8.2.3. 

All later versions of Brocade Fabric OS, including all FOS 9.X releases, will also contain this same security update.

Workaround

Minimizing exposure to this vulnerability can be done by the following means:

  • Using firewall and ipfilter to limit access to management interface from trusted hosts only;
  • clear browser cache

Credit

This issue was discovered through security testing.

Revision History

Version Change Date
1.0 Initial Publication September 08, 2020
1.1 CVSS score Update November 20, 2020
2.0 Added 8.2.3  May 10, 2021