Vulnerability-Lookup

WID-SEC-W-2026-2562

Vulnerability from csaf_certbund - Published: 2026-07-28 22:00 - Updated: 2026-08-11 22:00

Summary

Broadcom Brocade SANnav: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Brocade SANnav ist eine Managementlösung für Storage Area Networks (SAN).

Angriff: Ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in Broadcom Brocade SANnav ausnutzen, um Informationen offenzulegen eine SQL Injektion durchzuführen und Daten zu manipulieren.

Betroffene Betriebssysteme: - Sonstiges

CVE-2026-5047

Affected products

Known affected 5 products

Product	Identifier	Version
Broadcom Brocade SANnav <3.0.0 Broadcom / Brocade SANnav		<3.0.0
Broadcom Brocade SANnav <2.4.0b Broadcom / Brocade SANnav		<2.4.0b
Broadcom Brocade SANnav <3.0.0a Broadcom / Brocade SANnav		<3.0.0a
Broadcom Brocade SANnav <3.0.1 Broadcom / Brocade SANnav		<3.0.1
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—

CVE-2026-5048

Affected products

Known affected 5 products

Product	Identifier	Version
Broadcom Brocade SANnav <2.4.0b Broadcom / Brocade SANnav		<2.4.0b
Broadcom Brocade SANnav <3.0.0 Broadcom / Brocade SANnav		<3.0.0
Broadcom Brocade SANnav <3.0.0a Broadcom / Brocade SANnav		<3.0.0a
Broadcom Brocade SANnav <3.0.1 Broadcom / Brocade SANnav		<3.0.1
Lenovo Computer Lenovo	`cpe:/h:lenovo:computer:-`	—

CVE-2026-5049

Affected products

Known affected 5 products, the same list as for CVE-2026-5048

References

6 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://support.broadcom.com/web/ecx/support-cont…	external
https://support.broadcom.com/web/ecx/support-cont…	external
https://support.broadcom.com/web/ecx/support-cont…	external
https://support.lenovo.com/us/en/product_security…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Brocade SANnav ist eine Managementl\u00f6sung f\u00fcr Storage Area Networks (SAN).",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in Broadcom Brocade SANnav ausnutzen, um Informationen offenzulegen eine SQL Injektion durchzuf\u00fchren und Daten zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2562 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2562.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2562 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2562"
      },
      {
        "category": "external",
        "summary": "Brocade Security Advisory vom 2026-07-28",
        "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37931"
      },
      {
        "category": "external",
        "summary": "Brocade Security Advisory vom 2026-07-28",
        "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37932"
      },
      {
        "category": "external",
        "summary": "Brocade Security Advisory vom 2026-07-28",
        "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37933"
      },
      {
        "category": "external",
        "summary": "Lenovo Security Advisory LEN-223274 vom 2026-08-12",
        "url": "https://support.lenovo.com/us/en/product_security/LEN-223274"
      }
    ],
    "source_lang": "en-US",
    "title": "Broadcom Brocade SANnav: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-08-11T22:00:00.000+00:00",
      "generator": {
        "date": "2026-08-12T07:32:04.003+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2562",
      "initial_release_date": "2026-07-28T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-07-28T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-08-11T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von LENOVO aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.4.0b",
                "product": {
                  "name": "Broadcom Brocade SANnav \u003c2.4.0b",
                  "product_id": "T050349"
                }
              },
              {
                "category": "product_version",
                "name": "2.4.0b",
                "product": {
                  "name": "Broadcom Brocade SANnav 2.4.0b",
                  "product_id": "T050349-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:broadcom:brocade_sannav:2.4.0b"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c3.0.0",
                "product": {
                  "name": "Broadcom Brocade SANnav \u003c3.0.0",
                  "product_id": "T057307"
                }
              },
              {
                "category": "product_version",
                "name": "3.0.0",
                "product": {
                  "name": "Broadcom Brocade SANnav 3.0.0",
                  "product_id": "T057307-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:broadcom:brocade_sannav:3.0.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c3.0.0a",
                "product": {
                  "name": "Broadcom Brocade SANnav \u003c3.0.0a",
                  "product_id": "T057308"
                }
              },
              {
                "category": "product_version",
                "name": "3.0.0a",
                "product": {
                  "name": "Broadcom Brocade SANnav 3.0.0a",
                  "product_id": "T057308-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:broadcom:brocade_sannav:3.0.0a"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c3.0.1",
                "product": {
                  "name": "Broadcom Brocade SANnav \u003c3.0.1",
                  "product_id": "T057309"
                }
              },
              {
                "category": "product_version",
                "name": "3.0.1",
                "product": {
                  "name": "Broadcom Brocade SANnav 3.0.1",
                  "product_id": "T057309-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:broadcom:brocade_sannav:3.0.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Brocade SANnav"
          }
        ],
        "category": "vendor",
        "name": "Broadcom"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Lenovo Computer",
            "product": {
              "name": "Lenovo Computer",
              "product_id": "T048897",
              "product_identification_helper": {
                "cpe": "cpe:/h:lenovo:computer:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Lenovo"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-5047",
      "product_status": {
        "known_affected": [
          "T057307",
          "T050349",
          "T057308",
          "T057309",
          "T048897"
        ]
      },
      "release_date": "2026-07-28T22:00:00.000+00:00",
      "title": "CVE-2026-5047"
    },
    {
      "cve": "CVE-2026-5048",
      "product_status": {
        "known_affected": [
          "T050349",
          "T057307",
          "T057308",
          "T057309",
          "T048897"
        ]
      },
      "release_date": "2026-07-28T22:00:00.000+00:00",
      "title": "CVE-2026-5048"
    },
    {
      "cve": "CVE-2026-5049",
      "product_status": {
        "known_affected": [
          "T050349",
          "T057307",
          "T057308",
          "T057309",
          "T048897"
        ]
      },
      "release_date": "2026-07-28T22:00:00.000+00:00",
      "title": "CVE-2026-5049"
    }
  ]
}

CVE-2026-5047 (GCVE-0-2026-5047)

Vulnerability from cvelistv5 – Published: 2026-10-08 05:18 – Updated: 2026-10-08 17:55

Summary

A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access the passwords.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 15:14 UTC

CWE

CWE-922 - Insecure Storage of Sensitive Information

Assigner

brocade mitre root Scorecard

References

1 reference

URL	Tags
https://support.broadcom.com/external/content/Sec…

Impacted products

1 product

Vendor	Product	Version
Brocade	Brocade SANnav	Affected: 0 , < 2.4.0b (Brocade SANnav) Affected: 3.0.0 (Brocade SANnav)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-5047",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T15:14:41.593097Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:55:19.289Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Brocade SANnav",
          "vendor": "Brocade",
          "versions": [
            {
              "lessThan": "2.4.0b",
              "status": "affected",
              "version": "0",
              "versionType": "Brocade SANnav"
            },
            {
              "status": "affected",
              "version": "3.0.0",
              "versionType": "Brocade SANnav"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and\u0026nbsp; authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access the passwords.\u003c/p\u003e"
            }
          ],
          "value": "A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and\u00a0 authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access the passwords."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-922",
              "description": "CWE-922: Insecure Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T05:18:55.977Z",
        "orgId": "87b297d7-335e-4844-9551-11b97995a791",
        "shortName": "brocade"
      },
      "references": [
        {
          "url": "https://support.broadcom.com/external/content/SecurityAdvisories/0/37933"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eSecurity update provided in Brocade SANnav 2.4.0b, 3.0.0 and 3.0.1\u003c/div\u003e"
            }
          ],
          "value": "Security update provided in Brocade SANnav 2.4.0b, 3.0.0 and 3.0.1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "87b297d7-335e-4844-9551-11b97995a791",
    "assignerShortName": "brocade",
    "cveId": "CVE-2026-5047",
    "datePublished": "2026-10-08T05:18:55.977Z",
    "dateReserved": "2026-03-27T16:45:32.682Z",
    "dateUpdated": "2026-10-08T17:55:19.289Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-5048 (GCVE-0-2026-5048)

Vulnerability from cvelistv5 – Published: 2026-10-08 05:23 – Updated: 2026-10-08 17:55

Summary

In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters.

Severity

6.1 (Medium)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 15:14 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

brocade mitre root Scorecard

References

1 reference

URL	Tags
https://support.broadcom.com/external/content/Sec…

Impacted products

1 product

Vendor	Product	Version
Brocade	Brocade SANnav	Affected: 0 , < 3.0.0a (Brocade SANnav)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-5048",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T15:14:40.317730Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:55:12.542Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Brocade SANnav",
          "vendor": "Brocade",
          "versions": [
            {
              "lessThan": "3.0.0a",
              "status": "affected",
              "version": "0",
              "versionType": "Brocade SANnav"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters.\u003c/p\u003e"
            }
          ],
          "value": "In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T05:23:56.926Z",
        "orgId": "87b297d7-335e-4844-9551-11b97995a791",
        "shortName": "brocade"
      },
      "references": [
        {
          "url": "https://support.broadcom.com/external/content/SecurityAdvisories/0/37932"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eSecurity update provided in Brocade SANnav 3.0.0a and 3.0.1\u003c/div\u003e\u003cbr\u003e"
            }
          ],
          "value": "Security update provided in Brocade SANnav 3.0.0a and 3.0.1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "87b297d7-335e-4844-9551-11b97995a791",
    "assignerShortName": "brocade",
    "cveId": "CVE-2026-5048",
    "datePublished": "2026-10-08T05:23:56.926Z",
    "dateReserved": "2026-03-27T16:45:35.378Z",
    "dateUpdated": "2026-10-08T17:55:12.542Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-5049 (GCVE-0-2026-5049)

Vulnerability from cvelistv5 – Published: 2026-10-08 05:29 – Updated: 2026-10-08 17:55

Summary

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 15:14 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

brocade mitre root Scorecard

References

1 reference

URL	Tags
https://support.broadcom.com/external/content/Sec…

Impacted products

1 product

Vendor	Product	Version
Brocade	Brocade SANnav	Affected: 0 , < 3.0.0a (Brocade SANnav)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-5049",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T15:14:39.118264Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:55:06.093Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Brocade SANnav",
          "vendor": "Brocade",
          "versions": [
            {
              "lessThan": "3.0.0a",
              "status": "affected",
              "version": "0",
              "versionType": "Brocade SANnav"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory.\u003c/p\u003e"
            }
          ],
          "value": "A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T05:29:14.707Z",
        "orgId": "87b297d7-335e-4844-9551-11b97995a791",
        "shortName": "brocade"
      },
      "references": [
        {
          "url": "https://support.broadcom.com/external/content/SecurityAdvisories/0/37931"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eSecurity update provided in Brocade SANnav 3.0.0a and 3.0.1\u003c/div\u003e"
            }
          ],
          "value": "Security update provided in Brocade SANnav 3.0.0a and 3.0.1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "87b297d7-335e-4844-9551-11b97995a791",
    "assignerShortName": "brocade",
    "cveId": "CVE-2026-5049",
    "datePublished": "2026-10-08T05:29:14.707Z",
    "dateReserved": "2026-03-27T16:45:35.436Z",
    "dateUpdated": "2026-10-08T17:55:06.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

WID-SEC-W-2026-2562

CVE-2026-5047 (GCVE-0-2026-5047)

CVE-2026-5048 (GCVE-0-2026-5048)

CVE-2026-5049 (GCVE-0-2026-5049)

Tags

Sightings

Nomenclature

Related by attack behaviour