« Volver al listado

CVE-2024-2859

Estado: AnalizadaAlta (7.2)—

By default, SANnav OVA is shipped with root user login enabled. While protected by a password, access to root could expose SANnav to a remote attacker should they gain access to the root account.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Broadcom — Brocade Sannav

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-2859",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-2859",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-20T18:34:08.744738Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "sirt@brocade.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "sirt@brocade.com",
      "affectedData": [
        {
          "vendor": "Brocade",
          "product": "Brocade SANnav",
          "versions": [
            {
              "status": "affected",
              "version": "v2.3.0"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:broadcom:brocade_sannav:2.3.0:*:*:*:*:*:*:*"
          ],
          "vendor": "broadcom",
          "product": "brocade_sannav",
          "versions": [
            {
              "status": "affected",
              "version": "2.3.0"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-04-27T00:15:07.010",
  "references": [
    {
      "url": "https://security.netapp.com/advisory/ntap-20240628-0003/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "sirt@brocade.com"
    },
    {
      "url": "https://support.broadcom.com/external/content/SecurityAdvisories/0/23245",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "sirt@brocade.com"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20240628-0003/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.broadcom.com/external/content/SecurityAdvisories/0/23245",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "By default, SANnav OVA is shipped with root user login enabled.  While protected by a password, access to root could expose SANnav to a remote attacker should they gain access to the root account."
    },
    {
      "lang": "es",
      "value": "De forma predeterminada, SANnav OVA se envía con el inicio de sesión de usuario raíz habilitado. Si bien está protegido por una contraseña, el acceso a la cuenta raíz podría exponer a SANnav a un atacante remoto en caso de que obtenga acceso a la cuenta raíz."
    }
  ],
  "lastModified": "2026-06-17T07:25:42.097",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:broadcom:brocade_sannav:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D4FED58-4527-4735-87F8-80B5664B7B4F",
              "versionEndExcluding": "2.3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "sirt@brocade.com"
}