CVE-2021-27791 Auth bypass in Brocade Fabric OS
An unauthenticated attacker can bypass authentication in Brocade Fabric OS by sending a malformed header, gaining unauthorized access to the web application service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27791?
CVE-2021-27791 is a medium-severity authentication bypass vulnerability in Broadcom Fabric Operating System, published on 12 Aug 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The function that is used to parse the Authentication header in Brocade Fabric OS Web application service before Brocade Fabric OS v9.0.1a and v8.2.3a fails to properly process a malformed authentication header from the client, resulting in reading memory addresses outside the intended range. An unauthenticated attacker could discover a request, which could bypass the authentication process.
Weakness: CWE-125
Which versions are affected by CVE-2021-27791?
It affects 1 product.
Products include Broadcom Fabric Operating System.
How do I fix CVE-2021-27791?
No fix has been published for CVE-2021-27791 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-27791 being exploited?
There is no known exploitation of CVE-2021-27791 in the wild and no public exploit code.
Other vulnerabilities in Broadcom Fabric Operating System
Sources
Also known as GHSA-vg73-mjx3-8p9g.