Brocade ASCG Web Interface HSTS Enforcement Vulnerability

A vulnerability exists in the Brocade ASCG web interface in versions prior to 3.2.0, where the server does not enforce HTTP Strict Transport Security (HSTS) as specified by RFC 6797. This absence of HSTS allows for downgrade attacks, SSL-stripping man-in-the-middle attacks, and reduces the effectiveness of cookie-hijacking protections.

Impact

The lack of HSTS enforcement can lead to downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakened protections against cookie hijacking.

Remediation

Users can upgrade to Brocade ASCG version 3.2.0 or later, where this vulnerability has been addressed.