FKIE_CVE-2018-6447
Vulnerability from fkie_nvd - Published: 2020-09-25 14:15 - Updated: 2026-06-17 02:01
Severity
Summary
A Reflective XSS Vulnerability in HTTP Management Interface in Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, v7.4.2g could allow authenticated attackers with access to the web interface to hijack a user’s session and take over the account.
References
Impacted products
{
"affected": [
{
"affectedData": [
{
"product": "Brocade Fabric OS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Brocade Fabric OS versions before v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, v7.4.2g"
}
]
}
],
"source": "sirt@brocade.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1B419E9E-A92F-4773-B64D-F6A9D595666E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "09357B7C-2D5C-4C4C-A630-92E93A00F366",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "48535F1A-DDEA-4225-9592-7890E3CB7F64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:5.0.5b:*:*:*:*:*:*:*",
"matchCriteriaId": "569C1E6A-AD15-460D-91B2-03ABDF79925A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D149E5D3-33E7-4904-975B-6FEBC5D0D120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:5.2.0a:*:*:*:*:*:*:*",
"matchCriteriaId": "8A3BF2BB-6323-4EFA-A76B-6EAC79C5E784",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:7.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "847D6D8A-9DC1-4FA5-A204-BBC5A319DE91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:7.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D5D67948-5C26-4CA3-BD1E-025AFF96AD97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:7.4.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "6E1ECDF7-A972-4AFB-B6DB-BE81DE44E6C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:7.4.1b:*:*:*:*:*:*:*",
"matchCriteriaId": "C8237571-12FD-4871-9F30-3D0A9F956E4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:7.4.1c:*:*:*:*:*:*:*",
"matchCriteriaId": "916020DF-D1BC-4051-8492-88B4836CD91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:7.4.1d:*:*:*:*:*:*:*",
"matchCriteriaId": "5CA0FD46-871D-4E19-89D6-B6BB73C2C315",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:7.4.1e:*:*:*:*:*:*:*",
"matchCriteriaId": "7C9EF300-4DBC-4ECA-8A49-9A2D0027E35C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:7.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2FEAE07D-906E-4B7C-B577-14D15CFFB69C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:7.4.2a:*:*:*:*:*:*:*",
"matchCriteriaId": "8A589310-66AB-4D4F-A332-64E245AB1D0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:7.4.2b:*:*:*:*:*:*:*",
"matchCriteriaId": "F633FD3F-8224-4D96-BD0C-55EA218D4364",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:7.4.2c:*:*:*:*:*:*:*",
"matchCriteriaId": "656001D2-F17B-49C0-9F38-E84B5CE3E088",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:7.4.2d:*:*:*:*:*:*:*",
"matchCriteriaId": "9761DF12-141D-4109-805D-449B5495ACB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:7.4.2f:*:*:*:*:*:*:*",
"matchCriteriaId": "DD207CDF-7BF9-4FBD-86C4-C24B66D219FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A234DD0C-6C62-4A5E-B093-14F54710C2F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CA532CBE-FCAF-4AE7-9A39-808864223E41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.0.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "B31089DE-FCE6-4CE2-9175-DE852DA725BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.0.1b:*:*:*:*:*:*:*",
"matchCriteriaId": "7C290579-59BF-4465-8D02-4A9154C3615D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3C9EBAFF-2358-4EEC-9E83-EBCAC8805414",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.0.2a:*:*:*:*:*:*:*",
"matchCriteriaId": "C9367275-F4B3-4BC1-BE50-00A9AFA84B06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.0.2b:*:*:*:*:*:*:*",
"matchCriteriaId": "7CF2C554-5F8A-401F-8E0B-C686EE644CAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.0.2c:*:*:*:*:*:*:*",
"matchCriteriaId": "17139A37-3F57-4063-ADD4-FFF6813C0A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.0.2d:*:*:*:*:*:*:*",
"matchCriteriaId": "3FC5B110-36D5-4311-A4C2-E23CFC46F527",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.0.2f:*:*:*:*:*:*:*",
"matchCriteriaId": "08E5445F-89A9-4C9E-8F46-19F1279ED363",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7727C720-11C5-48DA-B604-6D296B0A9521",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.1.0a:*:*:*:*:*:*:*",
"matchCriteriaId": "924F8C74-0EEC-4D77-AD24-8EFCD0FDF8A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.1.0b:*:*:*:*:*:*:*",
"matchCriteriaId": "68A9B3C1-2C1D-4D7D-BCFB-ECD1D78A9BC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.1.0c:*:*:*:*:*:*:*",
"matchCriteriaId": "3F2277EA-698F-4874-BDEF-609AACE35C81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "79418EEC-72C2-4A85-97CE-7B472E9AAF79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.1.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "8C1E9751-0A3F-44EC-8BF1-0192519B21D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E064A2B0-8316-4192-A319-81778BE7923C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.1.2a:*:*:*:*:*:*:*",
"matchCriteriaId": "EFA12D62-012C-4379-8DBC-F6439AFA56B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.1.2b:*:*:*:*:*:*:*",
"matchCriteriaId": "B419A050-C6B3-44A3-8C53-7CAA4FDA26E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.1.2c:*:*:*:*:*:*:*",
"matchCriteriaId": "FB143EE1-4E8A-4ED5-B890-195686BF8F57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.1.2d:*:*:*:*:*:*:*",
"matchCriteriaId": "C5159821-59B6-47BC-B888-BE122D022980",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.1.2e:*:*:*:*:*:*:*",
"matchCriteriaId": "0BD8C47B-ADDA-4863-85C7-DEACBEF3824F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.1.2f:*:*:*:*:*:*:*",
"matchCriteriaId": "9E7E1958-4EE9-443D-B648-B937C4A29478",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.1.2j:*:*:*:*:*:*:*",
"matchCriteriaId": "BB7656E4-4F68-4B98-A682-13A1D13600EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FB05F642-6396-4FBC-BF59-3C7D513FC022",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.2.0a:*:*:*:*:*:*:*",
"matchCriteriaId": "8E46B701-EF2B-4EF3-AE28-E6DC700F5B8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0C91FB6C-7BF5-453E-A618-06756D3DD2FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.2.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "7CF38E78-8243-4615-A8A1-1396920F5BA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.2.1b:*:*:*:*:*:*:*",
"matchCriteriaId": "84E4F075-D03B-4D98-8C9E-840D80DFFF48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.2.1c:*:*:*:*:*:*:*",
"matchCriteriaId": "CDDF78F1-A7F3-4656-AD5D-6D84F83B34F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.2.1d:*:*:*:*:*:*:*",
"matchCriteriaId": "DAA3D3F6-C768-4096-A2CA-8CC406A92D6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B244FB24-0767-4DC4-9988-ED8C5D9D9A91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.2.2a:*:*:*:*:*:*:*",
"matchCriteriaId": "7DDA4E8C-F140-4E39-9A6F-7883F2822499",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.2.2a1:*:*:*:*:*:*:*",
"matchCriteriaId": "441E912B-4DD8-4A04-8072-04CE30D5A436",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.2.2b:*:*:*:*:*:*:*",
"matchCriteriaId": "B3B33CEA-BE17-411D-86FF-388B21E8F018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:broadcom:fabric_operating_system:8.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "8B8758BE-527C-40EA-BFE6-848A1C87723F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Reflective XSS Vulnerability in HTTP Management Interface in Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, v7.4.2g could allow authenticated attackers with access to the web interface to hijack a user\u2019s session and take over the account."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo XSS Reflexivo en la Interfaz de Administraci\u00f3n HTTP en Brocade Fabric OS versiones anteriores a Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, v7.4.2g, podr\u00eda permitir a atacantes autenticados con acceso a la interfaz web secuestrar la sesi\u00f3n de un usuario y tomar el control de la cuenta"
}
],
"id": "CVE-2018-6447",
"lastModified": "2026-06-17T02:01:50.977",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-09-25T14:15:13.110",
"references": [
{
"source": "sirt@brocade.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1073"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1073"
}
],
"sourceIdentifier": "sirt@brocade.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…