CVE-2024-29961CWE-200

supply-chain attack risk

High · published April 19, 2024

CVSS v3.1
8.2
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

A vulnerability affects Brocade SANnav before v2.3.1 and v2.3.0a. It allows a Brocade SANnav service to send ping commands in the background at regular intervals to gridgain.com to check if updates are available for the Component. This could make an unauthenticated, remote attacker aware of the behavior and launch a supply-chain attack against a Brocade SANnav appliance.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00756 · 54.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2024-04-19T03:59Z
EPSS history
Timeline
  • 19 APR 03:59Z
    supply-chain attack risk
    cvelistv5