{"id":"CVE-2024-2860","state":"PUBLISHED","title":"The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM where the Brocade SANna","description":"The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM where the Brocade SANnav is installed can gain access to sensitive data inside the PostgreSQL database.\n ","publishedAt":"2024-05-08T01:01:54.775Z","updatedAt":"2024-08-01T19:25:42.147Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"brocade"},"assigner":"brocade","products":["Brocade Brocade SAnnav"],"affected":[{"vendor":"Brocade","product":"Brocade SAnnav","defaultStatus":"unaffected","versions":[{"version":"before SANnav v2.3.0a","status":"affected"}]}],"references":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24260"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:07:21.467Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/2xxx/CVE-2024-2860.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-2860","state":"PUBLISHED","datePublished":"2024-05-08T01:01:54.775Z","dateUpdated":"2024-08-01T19:25:42.147Z","assignerShortName":"brocade","assignerOrgId":"87b297d7-335e-4844-9551-11b97995a791","dateReserved":"2024-03-24T01:29:52.208Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM where the Brocade SANnav is installed can gain access to sensitive data inside the PostgreSQL database.\n "}],"affected":[{"vendor":"Brocade","product":"Brocade SAnnav","defaultStatus":"unaffected","versions":[{"version":"before SANnav v2.3.0a","status":"affected"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24260"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"brocade","orgId":"87b297d7-335e-4844-9551-11b97995a791","dateUpdated":"2024-05-08T01:01:54.775Z"},"impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"brocade","product":"sannav","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"2.3.0a","versionType":"custom"}],"cpes":["cpe:2.3:a:brocade:sannav:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-2860","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-08T15:12:15.827191Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:29:17.299Z"}},{"title":"CVE Program Container","references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24260","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T19:25:42.147Z"}}]}}}