Knowledge of full path name
CVE-2023-31427

7.8HIGH

Key Information:

Vendor

Brocade
Status
Fabric Os
Vendor
CVE Published:
1 August 2023

What is CVE-2023-31427?

A local user with knowledge of full path names in Brocade Fabric OS can execute commands without permission checks on affected versions prior to v9.1.1c and v9.2.0. This flaw permits unauthorized operations, presenting a significant security risk. Notably, starting from Fabric OS v9.1.0, access to the 'root' account has been restricted, necessitating prompt updates to mitigate potential exploits.

Affected Version(s)

Fabric OS after 9.1.0 and before Brocade Fabric OS v9.2.0 and v9.1.1c

References

https://support.broadcom.com/external/content/SecurityAdv...
https://security.netapp.com/advisory/ntap-20230908-0007/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.