Search criteria
5 vulnerabilities found for Brocade Fabric OS by Broadcom
CVE-2025-4663 (GCVE-0-2025-4663)
Vulnerability from nvd – Published: 2025-07-08 17:53 – Updated: 2025-07-08 18:02
VLAI?
Title
Denial-of-Service (DoS) after Unusual or Exceptional Conditions vulnerability
Summary
An Improper Check for Unusual or
Exceptional Conditions vulnerability in Brocade Fabric OS before 9.2.2.a
could allow an authenticated, network-based attacker to cause a
Denial-of-Service (DoS).
The
vulnerability is encountered when supportsave is invoked remotely,
using ssh command or SANnav inline ssh, and the corresponding ssh
session is terminated with Control C (^c ) before supportsave
completion.
This issue affects Brocade Fabric OS 9.0.0 through 9.2.2
Severity ?
CWE
- CWE-754 - Improper Check for Unusual or Exceptional Conditions
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Broadcom | Brocade Fabric OS |
Affected:
Brocade Fabric OS 9.0.0 through 9.2.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-4663",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-08T18:01:53.887893Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T18:02:03.446Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Brocade Fabric OS",
"vendor": "Broadcom",
"versions": [
{
"status": "affected",
"version": "Brocade Fabric OS 9.0.0 through 9.2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn Improper Check for Unusual or \nExceptional Conditions vulnerability in Brocade Fabric OS before 9.2.2.a\n could allow an authenticated, network-based attacker to cause a \nDenial-of-Service (DoS).\u003cbr\u003eThe\n vulnerability is encountered when supportsave is invoked remotely, \nusing ssh command or SANnav inline ssh, and the corresponding ssh \nsession is terminated with Control C (^c ) before supportsave \ncompletion.\u003cbr\u003eThis issue affects Brocade Fabric OS 9.0.0 through 9.2.2\u003c/p\u003e"
}
],
"value": "An Improper Check for Unusual or \nExceptional Conditions vulnerability in Brocade Fabric OS before 9.2.2.a\n could allow an authenticated, network-based attacker to cause a \nDenial-of-Service (DoS).\nThe\n vulnerability is encountered when supportsave is invoked remotely, \nusing ssh command or SANnav inline ssh, and the corresponding ssh \nsession is terminated with Control C (^c ) before supportsave \ncompletion.\nThis issue affects Brocade Fabric OS 9.0.0 through 9.2.2"
}
],
"impacts": [
{
"capecId": "CAPEC-131",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-131 Resource Leak Exposure"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T17:53:53.048Z",
"orgId": "87b297d7-335e-4844-9551-11b97995a791",
"shortName": "brocade"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35815"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Denial-of-Service (DoS) after Unusual or Exceptional Conditions vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "87b297d7-335e-4844-9551-11b97995a791",
"assignerShortName": "brocade",
"cveId": "CVE-2025-4663",
"datePublished": "2025-07-08T17:53:53.048Z",
"dateReserved": "2025-05-13T18:34:47.831Z",
"dateUpdated": "2025-07-08T18:02:03.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-4663 (GCVE-0-2025-4663)
Vulnerability from cvelistv5 – Published: 2025-07-08 17:53 – Updated: 2025-07-08 18:02
VLAI?
Title
Denial-of-Service (DoS) after Unusual or Exceptional Conditions vulnerability
Summary
An Improper Check for Unusual or
Exceptional Conditions vulnerability in Brocade Fabric OS before 9.2.2.a
could allow an authenticated, network-based attacker to cause a
Denial-of-Service (DoS).
The
vulnerability is encountered when supportsave is invoked remotely,
using ssh command or SANnav inline ssh, and the corresponding ssh
session is terminated with Control C (^c ) before supportsave
completion.
This issue affects Brocade Fabric OS 9.0.0 through 9.2.2
Severity ?
CWE
- CWE-754 - Improper Check for Unusual or Exceptional Conditions
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Broadcom | Brocade Fabric OS |
Affected:
Brocade Fabric OS 9.0.0 through 9.2.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-4663",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-08T18:01:53.887893Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T18:02:03.446Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Brocade Fabric OS",
"vendor": "Broadcom",
"versions": [
{
"status": "affected",
"version": "Brocade Fabric OS 9.0.0 through 9.2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn Improper Check for Unusual or \nExceptional Conditions vulnerability in Brocade Fabric OS before 9.2.2.a\n could allow an authenticated, network-based attacker to cause a \nDenial-of-Service (DoS).\u003cbr\u003eThe\n vulnerability is encountered when supportsave is invoked remotely, \nusing ssh command or SANnav inline ssh, and the corresponding ssh \nsession is terminated with Control C (^c ) before supportsave \ncompletion.\u003cbr\u003eThis issue affects Brocade Fabric OS 9.0.0 through 9.2.2\u003c/p\u003e"
}
],
"value": "An Improper Check for Unusual or \nExceptional Conditions vulnerability in Brocade Fabric OS before 9.2.2.a\n could allow an authenticated, network-based attacker to cause a \nDenial-of-Service (DoS).\nThe\n vulnerability is encountered when supportsave is invoked remotely, \nusing ssh command or SANnav inline ssh, and the corresponding ssh \nsession is terminated with Control C (^c ) before supportsave \ncompletion.\nThis issue affects Brocade Fabric OS 9.0.0 through 9.2.2"
}
],
"impacts": [
{
"capecId": "CAPEC-131",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-131 Resource Leak Exposure"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T17:53:53.048Z",
"orgId": "87b297d7-335e-4844-9551-11b97995a791",
"shortName": "brocade"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35815"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Denial-of-Service (DoS) after Unusual or Exceptional Conditions vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "87b297d7-335e-4844-9551-11b97995a791",
"assignerShortName": "brocade",
"cveId": "CVE-2025-4663",
"datePublished": "2025-07-08T17:53:53.048Z",
"dateReserved": "2025-05-13T18:34:47.831Z",
"dateUpdated": "2025-07-08T18:02:03.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
VAR-202303-1599
Vulnerability from variot - Updated: 2025-06-09 22:06An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection. Haxx of libcurl Products from other vendors have authentication vulnerabilities.Information may be obtained. Description This CVE is under investigation by Red Hat Product Security. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202310-12
https://security.gentoo.org/
Severity: High Title: curl: Multiple Vulnerabilities Date: October 11, 2023 Bugs: #887745, #894676, #902801, #906590, #910564, #914091, #915195 ID: 202310-12
Synopsis
Multiple vulnerabilities have been discovered in curl, the worst of which could result in arbitrary code execution.
Background
A command line tool and library for transferring data with URLs.
Affected packages
Package Vulnerable Unaffected
net-misc/curl < 8.3.0-r2 >= 8.3.0-r2
Description
Multiple vulnerabilities have been discovered in curl. Please review the CVE identifiers referenced below for details.
Impact
Please review the referenced CVE identifiers for details.
Note that the risk of remote code execution is limited to SOCKS usage.
Workaround
There is no known workaround at this time.
Resolution
All curl users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/curl-8.3.0-r2"
References
[ 1 ] CVE-2022-43551 https://nvd.nist.gov/vuln/detail/CVE-2022-43551 [ 2 ] CVE-2022-43552 https://nvd.nist.gov/vuln/detail/CVE-2022-43552 [ 3 ] CVE-2023-23914 https://nvd.nist.gov/vuln/detail/CVE-2023-23914 [ 4 ] CVE-2023-23915 https://nvd.nist.gov/vuln/detail/CVE-2023-23915 [ 5 ] CVE-2023-23916 https://nvd.nist.gov/vuln/detail/CVE-2023-23916 [ 6 ] CVE-2023-27533 https://nvd.nist.gov/vuln/detail/CVE-2023-27533 [ 7 ] CVE-2023-27534 https://nvd.nist.gov/vuln/detail/CVE-2023-27534 [ 8 ] CVE-2023-27535 https://nvd.nist.gov/vuln/detail/CVE-2023-27535 [ 9 ] CVE-2023-27536 https://nvd.nist.gov/vuln/detail/CVE-2023-27536 [ 10 ] CVE-2023-27537 https://nvd.nist.gov/vuln/detail/CVE-2023-27537 [ 11 ] CVE-2023-27538 https://nvd.nist.gov/vuln/detail/CVE-2023-27538 [ 12 ] CVE-2023-28319 https://nvd.nist.gov/vuln/detail/CVE-2023-28319 [ 13 ] CVE-2023-28320 https://nvd.nist.gov/vuln/detail/CVE-2023-28320 [ 14 ] CVE-2023-28321 https://nvd.nist.gov/vuln/detail/CVE-2023-28321 [ 15 ] CVE-2023-28322 https://nvd.nist.gov/vuln/detail/CVE-2023-28322 [ 16 ] CVE-2023-32001 https://nvd.nist.gov/vuln/detail/CVE-2023-32001 [ 17 ] CVE-2023-38039 https://nvd.nist.gov/vuln/detail/CVE-2023-38039 [ 18 ] CVE-2023-38545 https://nvd.nist.gov/vuln/detail/CVE-2023-38545 [ 19 ] CVE-2023-38546 https://nvd.nist.gov/vuln/detail/CVE-2023-38546
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202310-12
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2023 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5 . ========================================================================== Ubuntu Security Notice USN-5964-1 March 20, 2023
curl vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in curl.
Software Description: - curl: HTTP, HTTPS, and FTP client and client libraries
Details:
Harry Sintonen discovered that curl incorrectly handled certain TELNET connection options. Due to lack of proper input scrubbing, curl could pass on user name and telnet options to the server as provided, contrary to expectations. (CVE-2023-27533)
Harry Sintonen discovered that curl incorrectly handled special tilde characters when used with SFTP paths. A remote attacker could possibly use this issue to circumvent filtering. (CVE-2023-27534)
Harry Sintonen discovered that curl incorrectly reused certain FTP connections. This could lead to the wrong credentials being reused, contrary to expectations. (CVE-2023-27535)
Harry Sintonen discovered that curl incorrectly reused connections when the GSS delegation option had been changed. This could lead to the option being reused, contrary to expectations. (CVE-2023-27536)
Harry Sintonen discovered that curl incorrectly reused certain SSH connections. This could lead to the wrong credentials being reused, contrary to expectations. (CVE-2023-27538)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.10: curl 7.85.0-1ubuntu0.5 libcurl3-gnutls 7.85.0-1ubuntu0.5 libcurl3-nss 7.85.0-1ubuntu0.5 libcurl4 7.85.0-1ubuntu0.5
Ubuntu 22.04 LTS: curl 7.81.0-1ubuntu1.10 libcurl3-gnutls 7.81.0-1ubuntu1.10 libcurl3-nss 7.81.0-1ubuntu1.10 libcurl4 7.81.0-1ubuntu1.10
Ubuntu 20.04 LTS: curl 7.68.0-1ubuntu2.18 libcurl3-gnutls 7.68.0-1ubuntu2.18 libcurl3-nss 7.68.0-1ubuntu2.18 libcurl4 7.68.0-1ubuntu2.18
Ubuntu 18.04 LTS: curl 7.58.0-2ubuntu3.24 libcurl3-gnutls 7.58.0-2ubuntu3.24 libcurl3-nss 7.58.0-2ubuntu3.24 libcurl4 7.58.0-2ubuntu3.24
In general, a standard system update will make all the necessary changes.
References: https://ubuntu.com/security/notices/USN-5964-1 CVE-2023-27533, CVE-2023-27534, CVE-2023-27535, CVE-2023-27536, CVE-2023-27538
Package Information: https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.5 https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.10 https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.18 https://launchpad.net/ubuntu/+source/curl/7.58.0-2ubuntu3.24
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202303-1599",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "brocade fabric operating system",
"scope": "eq",
"trust": 1.0,
"vendor": "broadcom",
"version": null
},
{
"model": "h500s",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"model": "universal forwarder",
"scope": "eq",
"trust": 1.0,
"vendor": "splunk",
"version": "9.1.0"
},
{
"model": "h700s",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"model": "h410s",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"model": "universal forwarder",
"scope": "gte",
"trust": 1.0,
"vendor": "splunk",
"version": "9.0.0"
},
{
"model": "universal forwarder",
"scope": "gte",
"trust": 1.0,
"vendor": "splunk",
"version": "8.2.0"
},
{
"model": "active iq unified manager",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "36"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "10.0"
},
{
"model": "universal forwarder",
"scope": "lt",
"trust": 1.0,
"vendor": "splunk",
"version": "8.2.12"
},
{
"model": "universal forwarder",
"scope": "lt",
"trust": 1.0,
"vendor": "splunk",
"version": "9.0.6"
},
{
"model": "clustered data ontap",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": "9.0"
},
{
"model": "h300s",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"model": "libcurl",
"scope": "lt",
"trust": 1.0,
"vendor": "haxx",
"version": "8.0.0"
},
{
"model": "libcurl",
"scope": "gte",
"trust": 1.0,
"vendor": "haxx",
"version": "7.16.1"
},
{
"model": "h300s",
"scope": null,
"trust": 0.8,
"vendor": "netapp",
"version": null
},
{
"model": "ontap",
"scope": null,
"trust": 0.8,
"vendor": "netapp",
"version": null
},
{
"model": "brocade fabric os",
"scope": null,
"trust": 0.8,
"vendor": "broadcom",
"version": null
},
{
"model": "gnu/linux",
"scope": null,
"trust": 0.8,
"vendor": "debian",
"version": null
},
{
"model": "fedora",
"scope": null,
"trust": 0.8,
"vendor": "fedora",
"version": null
},
{
"model": "libcurl",
"scope": null,
"trust": 0.8,
"vendor": "haxx",
"version": null
},
{
"model": "h410s",
"scope": null,
"trust": 0.8,
"vendor": "netapp",
"version": null
},
{
"model": "h700s",
"scope": null,
"trust": 0.8,
"vendor": "netapp",
"version": null
},
{
"model": "h500s",
"scope": null,
"trust": 0.8,
"vendor": "netapp",
"version": null
},
{
"model": "active iq unified manager",
"scope": null,
"trust": 0.8,
"vendor": "netapp",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-006571"
},
{
"db": "NVD",
"id": "CVE-2023-27538"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Gentoo",
"sources": [
{
"db": "PACKETSTORM",
"id": "175074"
}
],
"trust": 0.1
},
"cve": "CVE-2023-27538",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2023-27538",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.5,
"id": "CVE-2023-27538",
"impactScore": 5.2,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.5,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2023-27538",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2023-27538",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"id": "CVE-2023-27538",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2023-27538",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-202303-1552",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-006571"
},
{
"db": "CNNVD",
"id": "CNNVD-202303-1552"
},
{
"db": "NVD",
"id": "CVE-2023-27538"
},
{
"db": "NVD",
"id": "CVE-2023-27538"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection. Haxx of libcurl Products from other vendors have authentication vulnerabilities.Information may be obtained. Description\u003c!----\u003e This CVE is under investigation by Red Hat Product Security. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 202310-12\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: High\n Title: curl: Multiple Vulnerabilities\n Date: October 11, 2023\n Bugs: #887745, #894676, #902801, #906590, #910564, #914091, #915195\n ID: 202310-12\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been discovered in curl, the worst of\nwhich could result in arbitrary code execution. \n\nBackground\n==========\n\nA command line tool and library for transferring data with URLs. \n\nAffected packages\n=================\n\nPackage Vulnerable Unaffected\n------------- ------------ ------------\nnet-misc/curl \u003c 8.3.0-r2 \u003e= 8.3.0-r2\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in curl. Please review the\nCVE identifiers referenced below for details. \n\nImpact\n======\n\nPlease review the referenced CVE identifiers for details. \n\nNote that the risk of remote code execution is limited to SOCKS usage. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll curl users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=net-misc/curl-8.3.0-r2\"\n\nReferences\n==========\n\n[ 1 ] CVE-2022-43551\n https://nvd.nist.gov/vuln/detail/CVE-2022-43551\n[ 2 ] CVE-2022-43552\n https://nvd.nist.gov/vuln/detail/CVE-2022-43552\n[ 3 ] CVE-2023-23914\n https://nvd.nist.gov/vuln/detail/CVE-2023-23914\n[ 4 ] CVE-2023-23915\n https://nvd.nist.gov/vuln/detail/CVE-2023-23915\n[ 5 ] CVE-2023-23916\n https://nvd.nist.gov/vuln/detail/CVE-2023-23916\n[ 6 ] CVE-2023-27533\n https://nvd.nist.gov/vuln/detail/CVE-2023-27533\n[ 7 ] CVE-2023-27534\n https://nvd.nist.gov/vuln/detail/CVE-2023-27534\n[ 8 ] CVE-2023-27535\n https://nvd.nist.gov/vuln/detail/CVE-2023-27535\n[ 9 ] CVE-2023-27536\n https://nvd.nist.gov/vuln/detail/CVE-2023-27536\n[ 10 ] CVE-2023-27537\n https://nvd.nist.gov/vuln/detail/CVE-2023-27537\n[ 11 ] CVE-2023-27538\n https://nvd.nist.gov/vuln/detail/CVE-2023-27538\n[ 12 ] CVE-2023-28319\n https://nvd.nist.gov/vuln/detail/CVE-2023-28319\n[ 13 ] CVE-2023-28320\n https://nvd.nist.gov/vuln/detail/CVE-2023-28320\n[ 14 ] CVE-2023-28321\n https://nvd.nist.gov/vuln/detail/CVE-2023-28321\n[ 15 ] CVE-2023-28322\n https://nvd.nist.gov/vuln/detail/CVE-2023-28322\n[ 16 ] CVE-2023-32001\n https://nvd.nist.gov/vuln/detail/CVE-2023-32001\n[ 17 ] CVE-2023-38039\n https://nvd.nist.gov/vuln/detail/CVE-2023-38039\n[ 18 ] CVE-2023-38545\n https://nvd.nist.gov/vuln/detail/CVE-2023-38545\n[ 19 ] CVE-2023-38546\n https://nvd.nist.gov/vuln/detail/CVE-2023-38546\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/202310-12\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2023 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n. ==========================================================================\nUbuntu Security Notice USN-5964-1\nMarch 20, 2023\n\ncurl vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 22.10\n- Ubuntu 22.04 LTS\n- Ubuntu 20.04 LTS\n- Ubuntu 18.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in curl. \n\nSoftware Description:\n- curl: HTTP, HTTPS, and FTP client and client libraries\n\nDetails:\n\nHarry Sintonen discovered that curl incorrectly handled certain TELNET\nconnection options. Due to lack of proper input scrubbing, curl could pass\non user name and telnet options to the server as provided, contrary to\nexpectations. (CVE-2023-27533)\n\nHarry Sintonen discovered that curl incorrectly handled special tilde\ncharacters when used with SFTP paths. A remote attacker could possibly use\nthis issue to circumvent filtering. (CVE-2023-27534)\n\nHarry Sintonen discovered that curl incorrectly reused certain FTP\nconnections. This could lead to the wrong credentials being reused,\ncontrary to expectations. (CVE-2023-27535)\n\nHarry Sintonen discovered that curl incorrectly reused connections when the\nGSS delegation option had been changed. This could lead to the option being\nreused, contrary to expectations. (CVE-2023-27536)\n\nHarry Sintonen discovered that curl incorrectly reused certain SSH\nconnections. This could lead to the wrong credentials being reused,\ncontrary to expectations. (CVE-2023-27538)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 22.10:\n curl 7.85.0-1ubuntu0.5\n libcurl3-gnutls 7.85.0-1ubuntu0.5\n libcurl3-nss 7.85.0-1ubuntu0.5\n libcurl4 7.85.0-1ubuntu0.5\n\nUbuntu 22.04 LTS:\n curl 7.81.0-1ubuntu1.10\n libcurl3-gnutls 7.81.0-1ubuntu1.10\n libcurl3-nss 7.81.0-1ubuntu1.10\n libcurl4 7.81.0-1ubuntu1.10\n\nUbuntu 20.04 LTS:\n curl 7.68.0-1ubuntu2.18\n libcurl3-gnutls 7.68.0-1ubuntu2.18\n libcurl3-nss 7.68.0-1ubuntu2.18\n libcurl4 7.68.0-1ubuntu2.18\n\nUbuntu 18.04 LTS:\n curl 7.58.0-2ubuntu3.24\n libcurl3-gnutls 7.58.0-2ubuntu3.24\n libcurl3-nss 7.58.0-2ubuntu3.24\n libcurl4 7.58.0-2ubuntu3.24\n\nIn general, a standard system update will make all the necessary changes. \n\nReferences:\n https://ubuntu.com/security/notices/USN-5964-1\n CVE-2023-27533, CVE-2023-27534, CVE-2023-27535, CVE-2023-27536,\n CVE-2023-27538\n\nPackage Information:\n https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.5\n https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.10\n https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.18\n https://launchpad.net/ubuntu/+source/curl/7.58.0-2ubuntu3.24\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-27538"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-006571"
},
{
"db": "VULMON",
"id": "CVE-2023-27538"
},
{
"db": "PACKETSTORM",
"id": "175074"
},
{
"db": "PACKETSTORM",
"id": "171407"
}
],
"trust": 1.89
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-27538",
"trust": 3.5
},
{
"db": "HACKERONE",
"id": "1898475",
"trust": 2.4
},
{
"db": "ICS CERT",
"id": "ICSA-23-348-10",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-24-046-15",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-23-348-16",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU98271228",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU91198149",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2023-006571",
"trust": 0.8
},
{
"db": "AUSCERT",
"id": "ESB-2023.3327",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2023.2293",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2023.1917",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2023.3143",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2023.1733",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2023.3732",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202303-1552",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2023-27538",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "175074",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "171407",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-27538"
},
{
"db": "PACKETSTORM",
"id": "175074"
},
{
"db": "PACKETSTORM",
"id": "171407"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-006571"
},
{
"db": "CNNVD",
"id": "CNNVD-202303-1552"
},
{
"db": "NVD",
"id": "CVE-2023-27538"
}
]
},
"id": "VAR-202303-1599",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.625
},
"last_update_date": "2025-06-09T22:06:20.008000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "libcurl Remediation measures for authorization problem vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=232712"
},
{
"title": "Red Hat: ",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2023-27538"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-27538"
},
{
"db": "CNNVD",
"id": "CNNVD-202303-1552"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-305",
"trust": 1.0
},
{
"problemtype": "CWE-287",
"trust": 1.0
},
{
"problemtype": "Inappropriate authentication (CWE-287) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-006571"
},
{
"db": "NVD",
"id": "CVE-2023-27538"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://hackerone.com/reports/1898475"
},
{
"trust": 2.4,
"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html"
},
{
"trust": 2.4,
"url": "https://security.netapp.com/advisory/ntap-20230420-0010/"
},
{
"trust": 1.9,
"url": "https://security.gentoo.org/glsa/202310-12"
},
{
"trust": 1.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-27538"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98271228/index.html"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu91198149/index.html"
},
{
"trust": 0.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10"
},
{
"trust": 0.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-16"
},
{
"trust": 0.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-046-15"
},
{
"trust": 0.7,
"url": "https://access.redhat.com/security/cve/cve-2023-27538"
},
{
"trust": 0.6,
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36nbd5yljxxedzldgnfcerwryjq6laqw/"
},
{
"trust": 0.6,
"url": "https://curl.se/docs/cve-2023-27538.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2023.2293"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2023.3143"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2023.1733"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2023.3732"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2023.3327"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2023-27538/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2023.1917"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-27535"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-27533"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-27534"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-27536"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-28321"
},
{
"trust": 0.1,
"url": "https://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-28322"
},
{
"trust": 0.1,
"url": "https://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-23915"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-43552"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-32001"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-38545"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-38546"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-27537"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-38039"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-43551"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-28320"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-23916"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-23914"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-28319"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/curl/7.81.0-1ubuntu1.10"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/curl/7.85.0-1ubuntu0.5"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/curl/7.58.0-2ubuntu3.24"
},
{
"trust": 0.1,
"url": "https://ubuntu.com/security/notices/usn-5964-1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.18"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-27538"
},
{
"db": "PACKETSTORM",
"id": "175074"
},
{
"db": "PACKETSTORM",
"id": "171407"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-006571"
},
{
"db": "CNNVD",
"id": "CNNVD-202303-1552"
},
{
"db": "NVD",
"id": "CVE-2023-27538"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2023-27538"
},
{
"db": "PACKETSTORM",
"id": "175074"
},
{
"db": "PACKETSTORM",
"id": "171407"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-006571"
},
{
"db": "CNNVD",
"id": "CNNVD-202303-1552"
},
{
"db": "NVD",
"id": "CVE-2023-27538"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-10-11T16:50:55",
"db": "PACKETSTORM",
"id": "175074"
},
{
"date": "2023-03-21T17:30:09",
"db": "PACKETSTORM",
"id": "171407"
},
{
"date": "2023-11-15T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-006571"
},
{
"date": "2023-03-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202303-1552"
},
{
"date": "2023-03-30T20:15:07.677000",
"db": "NVD",
"id": "CVE-2023-27538"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-02-20T07:55:00",
"db": "JVNDB",
"id": "JVNDB-2023-006571"
},
{
"date": "2023-06-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202303-1552"
},
{
"date": "2025-06-09T15:15:29.150000",
"db": "NVD",
"id": "CVE-2023-27538"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202303-1552"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Haxx\u00a0 of \u00a0libcurl\u00a0 Authentication vulnerabilities in products from multiple vendors",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-006571"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202303-1552"
}
],
"trust": 0.6
}
}
VAR-201802-0641
Vulnerability from variot - Updated: 2024-11-23 23:12A vulnerability in the IPv6 stack on Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b, 8.1.2 and 8.2.0 could allow an attacker to cause a denial of service (CPU consumption and device hang) condition by sending crafted Router Advertisement (RA) messages to a targeted system. Brocade Fabric OS (FOS) Contains a resource management vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. BrocadeFibreChannelSANproducts are Brocade switches and BrocadeFabricOS (FOS) is an embedded system running on them. Security vulnerabilities exist in BrocadeFibreChannelSAN products prior to BrocadeFOS7.4.2b, pre-8.1.2, and pre-8.0.6 IPv6 stacks. Broadcom Fabric OS is prone to a remote denial-of-service vulnerability. Exploiting this issue allows remote attackers to cause a denial-of-service condition due to excessive CPU consumption. Versions prior to Broadcom Fabric OS 7.4.2b, 8.1.2 and 8.2.0 are vulnerable
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201802-0641",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "fabric operating system",
"scope": "eq",
"trust": 1.0,
"vendor": "broadcom",
"version": "8.1.0"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 1.0,
"vendor": "brocade",
"version": "8.0.2b2"
},
{
"model": "fabric operating system",
"scope": "eq",
"trust": 1.0,
"vendor": "broadcom",
"version": "8.0.1"
},
{
"model": "fabric operating system",
"scope": "eq",
"trust": 1.0,
"vendor": "broadcom",
"version": "8.1.1"
},
{
"model": "fabric operating system",
"scope": "eq",
"trust": 1.0,
"vendor": "broadcom",
"version": "8.0.2"
},
{
"model": "fabric operating system",
"scope": "eq",
"trust": 1.0,
"vendor": "broadcom",
"version": "8.0.0"
},
{
"model": "fabric operating system",
"scope": "lt",
"trust": 1.0,
"vendor": "broadcom",
"version": "7.4.2b"
},
{
"model": "fabric operating system",
"scope": "eq",
"trust": 1.0,
"vendor": "broadcom",
"version": "8.1.2"
},
{
"model": "fabric os",
"scope": null,
"trust": 0.8,
"vendor": "brocade",
"version": null
},
{
"model": "fibre channel san \u003c7.4.2b",
"scope": null,
"trust": 0.6,
"vendor": "brocade",
"version": null
},
{
"model": "fibre channel san",
"scope": "lt",
"trust": 0.6,
"vendor": "brocade",
"version": "8.1.2"
},
{
"model": "fibre channel san",
"scope": "lt",
"trust": 0.6,
"vendor": "brocade",
"version": "8.2.0"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "8.1.1a"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": null
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "8.1.2a"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "2.1.2"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "3.1"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "8.1.0c"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "5.0.5b"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "2.2"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "8.1.0"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "8.1.1"
},
{
"model": "brocade fabric os",
"scope": "eq",
"trust": 0.3,
"vendor": "broadcom",
"version": "8.1.1"
},
{
"model": "brocade fabric os",
"scope": "eq",
"trust": 0.3,
"vendor": "broadcom",
"version": "8.0.2"
},
{
"model": "brocade fabric os",
"scope": "eq",
"trust": 0.3,
"vendor": "broadcom",
"version": "7.4.2"
},
{
"model": "brocade fabric os",
"scope": "ne",
"trust": 0.3,
"vendor": "broadcom",
"version": "8.2"
},
{
"model": "brocade fabric os",
"scope": "ne",
"trust": 0.3,
"vendor": "broadcom",
"version": "8.1.2"
},
{
"model": "brocade fabric os 7.4.2b",
"scope": "ne",
"trust": 0.3,
"vendor": "broadcom",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06324"
},
{
"db": "BID",
"id": "107056"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012501"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-252"
},
{
"db": "NVD",
"id": "CVE-2017-6227"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:brocade:fabric_os",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-012501"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The vendor reported this issue.",
"sources": [
{
"db": "BID",
"id": "107056"
}
],
"trust": 0.3
},
"cve": "CVE-2017-6227",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 6.1,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.5,
"id": "CVE-2017-6227",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.1,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.5,
"id": "CNVD-2018-06324",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 2.8,
"id": "CVE-2017-6227",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-6227",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2017-6227",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2018-06324",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201802-252",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06324"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012501"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-252"
},
{
"db": "NVD",
"id": "CVE-2017-6227"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability in the IPv6 stack on Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b, 8.1.2 and 8.2.0 could allow an attacker to cause a denial of service (CPU consumption and device hang) condition by sending crafted Router Advertisement (RA) messages to a targeted system. Brocade Fabric OS (FOS) Contains a resource management vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. BrocadeFibreChannelSANproducts are Brocade switches and BrocadeFabricOS (FOS) is an embedded system running on them. Security vulnerabilities exist in BrocadeFibreChannelSAN products prior to BrocadeFOS7.4.2b, pre-8.1.2, and pre-8.0.6 IPv6 stacks. Broadcom Fabric OS is prone to a remote denial-of-service vulnerability. \nExploiting this issue allows remote attackers to cause a denial-of-service condition due to excessive CPU consumption. \nVersions prior to Broadcom Fabric OS 7.4.2b, 8.1.2 and 8.2.0 are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-6227"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012501"
},
{
"db": "CNVD",
"id": "CNVD-2018-06324"
},
{
"db": "BID",
"id": "107056"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-6227",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012501",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2018-06324",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201802-252",
"trust": 0.6
},
{
"db": "BID",
"id": "107056",
"trust": 0.3
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06324"
},
{
"db": "BID",
"id": "107056"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012501"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-252"
},
{
"db": "NVD",
"id": "CVE-2017-6227"
}
]
},
"id": "VAR-201802-0641",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06324"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06324"
}
]
},
"last_update_date": "2024-11-23T23:12:15.046000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "BSA-2018-526",
"trust": 0.8,
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-526"
},
{
"title": "BrocadeFibreChannelSAN product BrocadeFabricOS denial of service vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/123357"
},
{
"title": "Brocade Fibre Channel SAN product Brocade Fabric OS Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=78366"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06324"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012501"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-252"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-399",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-012501"
},
{
"db": "NVD",
"id": "CVE-2017-6227"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-526"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6227"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-6227"
},
{
"trust": 0.6,
"url": "http://www.brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2018-526.htm"
},
{
"trust": 0.3,
"url": "http://www.broadcom.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06324"
},
{
"db": "BID",
"id": "107056"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012501"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-252"
},
{
"db": "NVD",
"id": "CVE-2017-6227"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2018-06324"
},
{
"db": "BID",
"id": "107056"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012501"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-252"
},
{
"db": "NVD",
"id": "CVE-2017-6227"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-06324"
},
{
"date": "2018-01-17T00:00:00",
"db": "BID",
"id": "107056"
},
{
"date": "2018-03-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-012501"
},
{
"date": "2018-02-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201802-252"
},
{
"date": "2018-02-08T22:29:00.270000",
"db": "NVD",
"id": "CVE-2017-6227"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-06324"
},
{
"date": "2018-01-17T00:00:00",
"db": "BID",
"id": "107056"
},
{
"date": "2018-03-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-012501"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201802-252"
},
{
"date": "2024-11-21T03:29:18.297000",
"db": "NVD",
"id": "CVE-2017-6227"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201802-252"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Brocade Fabric OS Resource management vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-012501"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "resource management error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201802-252"
}
],
"trust": 0.6
}
}
VAR-201802-0640
Vulnerability from variot - Updated: 2024-11-23 22:17Cross-site scripting (XSS) vulnerability in the web-based management interface of Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b, 8.1.2 and 8.2.0 could allow remote attackers to execute arbitrary code or access sensitive browser-based information. Brocade Fabric OS (FOS) Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. BrocadeFibreChannelSANproducts are Brocade switches and BrocadeFabricOS (FOS) is an embedded system running on them. Cross-site scripting vulnerabilities exist in BrocadeFibreChannelSAN products prior to BrocadeFOS7.4.2b, pre-8.1.2, and pre-8.0. Web-based management interfaces. This may help the attacker steal cookie-based authentication credentials and launch other attacks. Broadcom Brocade Fabric OS versions prior 7.4.2b, 8.1.2 and 8.2.0 are vulnerable
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201802-0640",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "fabric os",
"scope": "eq",
"trust": 1.6,
"vendor": "brocade",
"version": "8.1.0c1"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 1.6,
"vendor": "brocade",
"version": "8.0.1b1"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 1.6,
"vendor": "brocade",
"version": "8.0.2b1"
},
{
"model": "fabric operating system",
"scope": "eq",
"trust": 1.0,
"vendor": "broadcom",
"version": "8.1.1"
},
{
"model": "fabric operating system",
"scope": "eq",
"trust": 1.0,
"vendor": "broadcom",
"version": "8.0.2"
},
{
"model": "fabric operating system",
"scope": "lt",
"trust": 1.0,
"vendor": "broadcom",
"version": "7.4.2b"
},
{
"model": "fabric os",
"scope": null,
"trust": 0.8,
"vendor": "brocade",
"version": null
},
{
"model": "fibre channel san \u003c7.4.2b",
"scope": null,
"trust": 0.6,
"vendor": "brocade",
"version": null
},
{
"model": "fibre channel san",
"scope": "lt",
"trust": 0.6,
"vendor": "brocade",
"version": "8.1.2"
},
{
"model": "fibre channel san",
"scope": "lt",
"trust": 0.6,
"vendor": "brocade",
"version": "8.2.0"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "5.2.0"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "8.0.2d"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "8.1.1a"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "3.1"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "5.0.5b"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "5.2.0a"
},
{
"model": "fabric os",
"scope": "eq",
"trust": 0.6,
"vendor": "brocade",
"version": "8.0.2c"
},
{
"model": "brocade fabric os",
"scope": "eq",
"trust": 0.3,
"vendor": "broadcom",
"version": "8.1.1"
},
{
"model": "brocade fabric os",
"scope": "eq",
"trust": 0.3,
"vendor": "broadcom",
"version": "7.4.2"
},
{
"model": "brocade fabric os 7.4.2b",
"scope": null,
"trust": 0.3,
"vendor": "broadcom",
"version": null
},
{
"model": "brocade fabric os",
"scope": "ne",
"trust": 0.3,
"vendor": "broadcom",
"version": "8.2"
},
{
"model": "brocade fabric os",
"scope": "ne",
"trust": 0.3,
"vendor": "broadcom",
"version": "8.1.2"
},
{
"model": "brocade fabric os 7.4.2c",
"scope": "ne",
"trust": 0.3,
"vendor": "broadcom",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06323"
},
{
"db": "BID",
"id": "107051"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012605"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-253"
},
{
"db": "NVD",
"id": "CVE-2017-6225"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:brocade:fabric_os",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-012605"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Pawel Gocyla and Matt Byrne.",
"sources": [
{
"db": "BID",
"id": "107051"
}
],
"trust": 0.3
},
"cve": "CVE-2017-6225",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2017-6225",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CNVD-2018-06323",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"id": "CVE-2017-6225",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-6225",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2017-6225",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2018-06323",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201802-253",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06323"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012605"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-253"
},
{
"db": "NVD",
"id": "CVE-2017-6225"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in the web-based management interface of Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b, 8.1.2 and 8.2.0 could allow remote attackers to execute arbitrary code or access sensitive browser-based information. Brocade Fabric OS (FOS) Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. BrocadeFibreChannelSANproducts are Brocade switches and BrocadeFabricOS (FOS) is an embedded system running on them. Cross-site scripting vulnerabilities exist in BrocadeFibreChannelSAN products prior to BrocadeFOS7.4.2b, pre-8.1.2, and pre-8.0. Web-based management interfaces. This may help the attacker steal cookie-based authentication credentials and launch other attacks. \nBroadcom Brocade Fabric OS versions prior 7.4.2b, 8.1.2 and 8.2.0 are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-6225"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012605"
},
{
"db": "CNVD",
"id": "CNVD-2018-06323"
},
{
"db": "BID",
"id": "107051"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-6225",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012605",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2018-06323",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201802-253",
"trust": 0.6
},
{
"db": "BID",
"id": "107051",
"trust": 0.3
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06323"
},
{
"db": "BID",
"id": "107051"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012605"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-253"
},
{
"db": "NVD",
"id": "CVE-2017-6225"
}
]
},
"id": "VAR-201802-0640",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06323"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06323"
}
]
},
"last_update_date": "2024-11-23T22:17:39.368000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "BSA-2018-525",
"trust": 0.8,
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-525"
},
{
"title": "Patch for BrocadeFibreChannelSAN product BrocadeFabricOS cross-site scripting vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/123361"
},
{
"title": "Brocade Fibre Channel SAN product Brocade Fabric OS Fixes for cross-site scripting vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=78367"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06323"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012605"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-253"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-012605"
},
{
"db": "NVD",
"id": "CVE-2017-6225"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.3,
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-525"
},
{
"trust": 1.3,
"url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbst03851en_us"
},
{
"trust": 1.2,
"url": "http://www.brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2018-525.htm"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6225"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-6225"
},
{
"trust": 0.3,
"url": "http://www.broadcom.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06323"
},
{
"db": "BID",
"id": "107051"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012605"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-253"
},
{
"db": "NVD",
"id": "CVE-2017-6225"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2018-06323"
},
{
"db": "BID",
"id": "107051"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-012605"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-253"
},
{
"db": "NVD",
"id": "CVE-2017-6225"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-06323"
},
{
"date": "2018-01-17T00:00:00",
"db": "BID",
"id": "107051"
},
{
"date": "2018-03-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-012605"
},
{
"date": "2018-02-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201802-253"
},
{
"date": "2018-02-08T22:29:00.207000",
"db": "NVD",
"id": "CVE-2017-6225"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-06323"
},
{
"date": "2018-01-17T00:00:00",
"db": "BID",
"id": "107051"
},
{
"date": "2018-03-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-012605"
},
{
"date": "2018-02-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201802-253"
},
{
"date": "2024-11-21T03:29:18.123000",
"db": "NVD",
"id": "CVE-2017-6225"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201802-253"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Brocade Fabric OS Vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-012605"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201802-253"
}
],
"trust": 0.6
}
}