{"id":"CVE-2024-1509","state":"PUBLISHED","title":"Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100","description":"Brocade ASCG before 3.2.0 Web Interface  is not \nenforcing HSTS, as defined by RFC 6797. HSTS is an optional response \nheader that can be configured on the server to instruct the browser to \nonly communicate via HTTPS. The lack of HSTS allows downgrade attacks, \nSSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking \nprotections.","publishedAt":"2025-02-28T21:52:33.870Z","updatedAt":"2025-03-04T19:44:55.094Z","severity":{"score":7.6,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"brocade"},"assigner":"brocade","products":["Brocade ASCG"],"affected":[{"vendor":"Brocade","product":"ASCG","defaultStatus":"unaffected","versions":[{"version":"before 3.2.0","status":"affected"}]}],"references":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25428"],"weaknesses":["CWE-523"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/1xxx/CVE-2024-1509.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-1509","state":"PUBLISHED","datePublished":"2025-02-28T21:52:33.870Z","dateUpdated":"2025-03-04T19:44:55.094Z","assignerShortName":"brocade","assignerOrgId":"87b297d7-335e-4844-9551-11b97995a791","dateReserved":"2024-02-14T20:17:33.442Z"},"containers":{"cna":{"title":"Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100","descriptions":[{"lang":"en","value":"Brocade ASCG before 3.2.0 Web Interface  is not \nenforcing HSTS, as defined by RFC 6797. HSTS is an optional response \nheader that can be configured on the server to instruct the browser to \nonly communicate via HTTPS. The lack of HSTS allows downgrade attacks, \nSSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking \nprotections."}],"affected":[{"vendor":"Brocade","product":"ASCG","defaultStatus":"unaffected","versions":[{"version":"before 3.2.0","status":"affected"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25428"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","baseScore":7.6,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-523","description":"CWE-523: Unprotected Transport of Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"brocade","orgId":"87b297d7-335e-4844-9551-11b97995a791","dateUpdated":"2025-02-28T21:52:33.870Z"},"impacts":[{"capecId":"CAPEC-157","descriptions":[{"lang":"en","value":"CAPEC-157: Sniffing Attacks"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-04T19:44:36.614317Z","id":"CVE-2024-1509","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-04T19:44:55.094Z"}}]}}}