High severity · published May 8, 2024
CVE-2024-2860
The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM where the Brocade SANnav is installed can gain access to sensitive data inside the PostgreSQL database.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
Brocade SAnnav · Brocade
before SANnav v2.3.0a · source: vendor, NVD
SA
Sannav · Brocade
before 2.3.0a · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-2860
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-2860
Vendor Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24260
More from Brocade SAnnav
9.8
CVE-2024-4282
Weak TLS Ciphers on Brocade SANnav OVA SSH port 22
8.0
CVE-2026-5048
In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious…
7.2
CVE-2024-2240
Docker implementation in Brocade SANnav is missing Audit Rules.
5.7
CVE-2026-5049
A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a
5.7
CVE-2026-5047
A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files