Summary

Security Advisory ID : BSA-2020-1076

Component : Database credentials

Revision : 1.1

Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An unauthenticated malicious user with access to the configuration file may obtain the exposed password to gain access to the application database.

Affected Products

Brocade SANnav versions before v2.1.0.

Products Confirmed Not Vulnerable

No other Brocade Fibre Channel Products from Broadcom products are currently known to be affected by this vulnerability.

Solution

A security update is provided in Brocade SANnav 2.1.0.

Recommended Action

Brocade strongly recommends that all customers running the impacted version(s) upgrade to one of the identified patch levels or a higher version of Brocade SANnav to obtain this update.

Credit

This issue was discovered through security testing. 

Revision History