← Vulnerability feed

Vulnerability record · CVE-2019-16205 · published 8 November 2019

CVE-2019-16205: Broadcom brocade sannav vulnerability

Broadcom · Brocade Sannav

A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insufficiently random session ID for several post-authentication actions in the SANnav portal.

8.8 CVSS 3.1 High EPSS 1.3% · top 30.9% CWE-330 · CWE-330
8.8CVSS 3.1 base score, v2 4.3
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insufficiently random session ID for several post-authentication actions in the SANnav portal.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-864 Vendor Advisory
https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-864 Vendor Advisory

Track CVE-2019-16205 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-4173Broadcom brocade sannav information exposure vulnerabilityA vulnerability in Brocade SANnav exposes Kafka in the wan interface. The vulnerability could allow an unauthenticated attacker to perform various at…EPSS 0.59%9.8CVE-2024-29966Broadcom brocade sannav hard-coded credentials vulnerabilityBrocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The vu…EPSS 0.65%9.8CVE-2023-31424Broadcom brocade sannav authentication bypass by spoofing vulnerabilityBrocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorizat…EPSS 0.90%9.8CVE-2022-23305Log4j 1.x JDBCAppender SQL injection via logged inputThe JDBCAppender in Log4j 1.2.x builds SQL statements from configuration parameters and PatternLayout converters, so logged values such as the %m mes…EPSS 67%analysed9.8CVE-2019-16211Broadcom brocade sannav insufficiently protected credentials vulnerabilityBrocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability.EPSS 1.0%9.0CVE-2024-3596Freeradius vulnerabilityRADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject,…EPSS 15%8.8CVE-2022-23302Apache Log4j 1.x JMSSink JNDI deserialization remote code executionJMSSink in all versions of Log4j 1.x deserializes untrusted data when an attacker can write to the Log4j configuration or when the configuration refe…EPSS 64%analysed8.8CVE-2019-16212Broadcom brocade sannav vulnerabilityA vulnerability in Brocade SANnav versions before v2.1.0 could allow a remote authenticated attacker to conduct an LDAP injection. The vulnerability …EPSS 1.9%

Source: NIST National Vulnerability Database (record CVE-2019-16205), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.