Monthly
An authorization-logic bypass in the Brocade Fabric OS web management framework (all versions before 10.0.1) allows an authenticated, low-privileged user to circumvent inner Role-Based Access Control checks and lower the authorization mode of their active session, gaining access to configuration settings reserved for administrative roles. Exploitation is not trivial: it requires a valid low-privileged account, adjacent-network (management-plane) access, a vulnerable Fabric OS build, and the additional environmental conditions the vendor cites as the trigger; the weakness affects integrity only and does not by itself yield code execution or data disclosure. This is a MEDIUM-severity issue (vendor CVSS 4.0 base 6.9; independent CVSS 3.1 assessment AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) and no public exploit code or confirmed active exploitation was identified at time of analysis.
An authorization-logic bypass in the Brocade Fabric OS web management framework (all versions before 10.0.1) allows an authenticated, low-privileged user to circumvent inner Role-Based Access Control checks and lower the authorization mode of their active session, gaining access to configuration settings reserved for administrative roles. Exploitation is not trivial: it requires a valid low-privileged account, adjacent-network (management-plane) access, a vulnerable Fabric OS build, and the additional environmental conditions the vendor cites as the trigger; the weakness affects integrity only and does not by itself yield code execution or data disclosure. This is a MEDIUM-severity issue (vendor CVSS 4.0 base 6.9; independent CVSS 3.1 assessment AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) and no public exploit code or confirmed active exploitation was identified at time of analysis.