CVE-2022-43937— Brocade SANnav Information Disclosure Vulnerability
Quick assessment
Affected
Brocade SANnav
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Broadcom SANnav是美国博通（Broadcom）公司的一套SAN管理平台。 Broadcom SANnav 2.3.0和2.2.2之前版本存在日志信息泄露漏洞，该漏洞源于启用调试时敏感字段在日志中的记录，可能导致敏感信息的泄露。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-43937
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Brocade SANnav Information Disclosure Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Possible information exposure through log file vulnerability where sensitive fields are recorded in the debug-enabled logs when debugging is turned on in Brocade SANnav before 2.3.0 and 2.2.2a
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Broadcom SANnav 日志信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Broadcom SANnav是美国博通（Broadcom）公司的一套SAN管理平台。 Broadcom SANnav 2.3.0和2.2.2之前版本存在日志信息泄露漏洞，该漏洞源于启用调试时敏感字段在日志中的记录，可能导致敏感信息的泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-43937
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-43937
请登录查看更多情报信息。
Same Patch Batch · Brocade · 2024-11-21 · 7 CVEs total
| CVE-2022-43936 | 6.8 MEDIUM | Brocade Fabric OS switch passwords when debugging is enabled |
| CVE-2022-43934 | 6.5 MEDIUM | Weak Key-exchange algorithms |
| CVE-2022-43935 | 5.3 MEDIUM | Switch passwords and authorization IDs are printed in the embedded MLS DB file |
| CVE-2022-43933 | 4.4 MEDIUM | configuration secrets are logged in support-save |
| CVE-2024-7517 | Privileged escalation via crafted use of portcfg command | |
| CVE-2024-10403 | SFTP/FTP password could be captured in plain text in Supportsave generated from SANnav |
IV. Related Vulnerabilities
Same product: SANnav
-
CVE-2025-12774
SQL queries with sensitive information printed in logs with -
CVE-2025-12773
Plain password is generated in the audit logs while executin -
CVE-2025-12772
Plaintext Switch admin login password is seen in Brocade SAN -
CVE-2025-12679
Plain text pbe key visible in audit log during Brocade SANna -
CVE-2025-12680
Brocade SANnav DataBase plaintext password is logged in fail
Same vendor: Brocade
-
CVE-2026-0869
Application User custom defined accounts are not properly pa -
CVE-2025-58381
Directory transversal vulnerability in Brocade Fabric OS bef -
CVE-2025-9711
Privilege escalation in Brocade Fabric OS before 9.2.1c3, an -
CVE-2025-58380
Directory transversal vulnerability in Brocade Fabric OS bef -
CVE-2026-0383
Information disclosure in Brocade Fabric OS before 9.2.1c2,
Same weakness: CWE-532
-
CVE-2026-14948
Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnera -
CVE-2026-76375
Information Disclosure through Environment Data Logging in A -
CVE-2026-76374
Information Disclosure through Sensitive Data Logging in AD -
CVE-2020-37267
Renovate 19.180.0 before 23.25.1 Token Leakage via Logs -
CVE-2019-25766
Renovate before 19.38.7 Credential Exposure via Go Modules
V. Comments for CVE-2022-43937
No comments yet