Medium severity · published Nov 21, 2024
CVE-2022-43933
configuration secrets are logged in support-save
4.4
CVSS
0.3%
EPSS
No
On KEV
Description
An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are logged in supportsave. Supportsave file is generated by an admin user troubleshooting the switch. The Logged information may include usernames and passwords, and secret keys.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
SANnav · Brocade
before Brocade SANnav 2.2.2 · source: vendor
BS
Brocade Sannav · Broadcom
before 2.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43933
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43933
Vendor Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21221
More from SANnav
9.8
CVE-2024-4173
SANnav versions exposes Kafka in the wan interface.
9.8
CVE-2024-29966
hard-coded credentials in the documentation that appear as the appliance root password
8.7
CVE-2026-82368
Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend…
8.6
CVE-2026-82370
Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service
8.6
CVE-2026-82369
Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a