Brocade SANnav Clear Text Sensitive Information Logging Vulnerability

A vulnerability exists in Brocade SANnav versions prior to 2.3.1b, where the CalInvocationHandler component logs sensitive information in clear text. This issue could enable an authenticated, local attacker to access sensitive data from Brocade Fabric OS switches. Administrators could potentially retrieve passwords and SNMP responses containing AuthSecret and PrivSecret by collecting a 'supportsave' or accessing an already collected 'supportsave'. This vulnerability arises from an incomplete fix for CVE-2024-29952.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, including passwords and confidential SNMP data, such as AuthSecret and PrivSecret.

Remediation

Users can upgrade to Brocade SANnav versions 2.4.0 or 2.3.1b to address this vulnerability.