CVE-2024-29954: password management API prints sensitive information in log files
A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for protocols such as scp and sftp.
Detail. When the firmwaredownload command is incorrectly entered or points to an erroneous file, the firmware download log captures the failed command, including any password entered in the command line.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29954?
CVE-2024-29954 is a critical vulnerability due to its potential exposure of sensitive passwords in log files.
How do I fix CVE-2024-29954?
To fix CVE-2024-29954, upgrade to Brocade Fabric OS versions v9.2.1, v9.2.0b, v9.1.1d, or v8.2.3e.
Who is affected by CVE-2024-29954?
CVE-2024-29954 affects users of Brocade Fabric OS versions prior to v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e.
What information is exposed due to CVE-2024-29954?
CVE-2024-29954 exposes sensitive server passwords for protocols such as scp and sftp in log files.
What causes the vulnerability in CVE-2024-29954?
The vulnerability in CVE-2024-29954 is caused by the password management API improperly logging sensitive information.