Brocade SANnav Database Password Logging Vulnerability in Audit Logs

A vulnerability exists in Brocade SANnav versions prior to 2.4.0a, where the application could log database passwords in clear text within audit logs. This issue arises when the daily data dump collector executes docker commands, potentially exposing sensitive information. These audit logs are part of the local server VM's logging system, not managed by SANnav, and are only accessible to the server administrator of the host. SANnav administrators and users do not have visibility into these logs.

Impact

Exposed database passwords in clear text within local audit logs, accessible only to the host server admin.

Remediation

Users can upgrade to Brocade SANnav 2.4.0a to address this vulnerability.