Draft in the CWE catalog · 2 CVEs mapped
The product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
⚠️ A hidden gem for attackers! The TeleMessage service could inadvertently leak passwords in a memory dump, like a forgotten note left on a public table. 🚨 Think of it like a diner accidentally leaving its order slip on the counter—anyone can see what was just done, including sensitive information. In this case, the heap content of the JSP application acts as that unattended slip, revealing previously sent passwords over HTTP. This vulnerability may allow malicious actors to scoop up sensitive user passwords directly from memory dumps, potentially leading to account takeovers or unauthorized access. The consequences could be frustratingly real—imagine someone walking away with your secret sauce recipe!
Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmware download operation initiated by SANnav or through WebEM in a weblinker core dump that is later captured via supportsave.