configuration secrets are logged in support-save

published 2024-11-21 23 mo ago modified 2026-06-17 4 mo ago also EUVD-2022-46903

cvss: 4.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits: 0; none known

An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are logged in supportsave. Supportsave file is generated by an admin user troubleshooting the switch. The Logged information may include usernames and passwords, and secret keys.

Patch / fix

fixed in 1

broadcom brocade_sannav 2.2.2

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 23 mo ago (2024-11-21)

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.4	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	4.4	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected products

Brocade SANnav

Classification

Weakness

CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
CWE-532 Insertion of Sensitive Information into Log File

References

support.broadcom.com /web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21221
vendor-advisory

Sources

CVE List CVE-2022-43933
NVD CVE-2022-43933

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary