CVE-2024-29954CWE-312

password management API prints sensitive information in log files

Medium · published June 25, 2024

CVSS v3.1
5.9
EPSS
0%
Percentile
1.4
In the wild
Unconfirmed
What it is

A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for protocols such as scp and sftp.

Detail.

When the firmwaredownload command is incorrectly entered or points to an erroneous file, the firmware download log captures the failed command, including any password entered in the command line.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00114 · 1.4th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2024-06-25T23:42Z
EPSS history
Timeline
  • 25 JUN 23:42Z
    password management API prints sensitive information in log files
    cvelistv5