A vulnerability in the web management interface of Brocade Fabric OS versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow attackers to intercept or manipulate a users session ID.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Fabric_operating_system | Broadcom | 7.4.2 (including) | 7.4.2d (excluding) |
| Fabric_operating_system | Broadcom | 8.0.2 (including) | 8.0.2f (excluding) |
| Fabric_operating_system | Broadcom | 8.1.2 (including) | 8.1.2f (excluding) |
| Fabric_operating_system | Broadcom | 8.2.0 (including) | 8.2.1 (excluding) |
Such a scenario is commonly observed when: