CVE-2024-1509
Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100
- State
- Published
- Severity
- 7.6 High
- Published
- Feb 28, 2025
- Updated
- Mar 4, 2025
- Reserved
- Feb 14, 2024
Description
Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.6 High | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | brocade |
Weaknesses
- CWE-523 Unprotected Transport of Credentials
Affected Products
| Product | Versions |
|---|---|
ASCGBrocade |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.