{"id":"CVE-2024-29964","aliases":["EUVD-2024-26938","GHSA-p68r-f2j8-7389"],"status":"published","title":"Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files","description":"Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. An unprivileged attacker who gains access to the server can read sensitive information from these files.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0052,"percentile":0.44469,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200","CWE-732"],"published":"2024-04-19T04:39:17Z","modified":"2026-06-17T07:23:27Z","products":[{"vendor":"broadcom","product":"brocade_sannav"},{"vendor":"brocade","product":"brocade sannav"},{"vendor":"brocade","product":"sannav"}],"references":[{"url":"https://support.broadcom.com/external/content/SecurityAdvisories/0/23249","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29964"},{"url":"https://github.com/advisories/GHSA-p68r-f2j8-7389"}],"sources":{"cve":[{"id":"CVE-2024-29964","title":"Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files","description":"Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. An unprivileged attacker who gains access to the server can read sensitive information from these files.","status":"published","published":"2024-04-19T04:39:17.273Z","modified":"2024-09-18T22:30:38.12Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:34:15.337999Z"}],"euvd":[{"id":"EUVD-2024-26938","description":"Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. An unprivileged attacker who gains access to the server can read sensitive information from these files.","status":"published","published":"2024-04-19T04:39:17Z","modified":"2024-09-18T22:30:38Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:19.564867Z"}],"ghsa":[{"id":"GHSA-p68r-f2j8-7389","title":"Docker instances in Brocade SANnav before v2.3.1 and v2.3.0a have an insecure architecture and...","description":"Docker instances in Brocade SANnav before v2.3.1 and v2.3.0a have an insecure architecture and configuration that leads to multiple vulnerabilities. Docker daemons are exposed to the WAN interface, and other vulnerabilities allow total control over the Ova appliance. A Docker instance could access any other instances, and a few could access sensitive files. The vulnerability could allow a sudo privileged user on the underlying OS to access and modify these files.\n","status":"published","published":"2024-04-19T06:30:28Z","modified":"2024-09-19T00:32:36Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-732"],"updated_at":"2026-11-02T14:58:18.045833Z"}],"nvd":[{"id":"CVE-2024-29964","description":"Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. An unprivileged attacker who gains access to the server can read sensitive information from these files.","status":"published","published":"2024-04-19T05:15:49.217Z","modified":"2026-06-17T07:23:27.007Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:09:53.50104Z"}]}}