Threats tagged 'ghsa-fx77-wm35-pp29'

A missing authorization vulnerability in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authenticated low-privileged (read-only) user to execute CLI show commands beyond their intended permissions. This leads to disclosure of sensitive information such as device configuration and password hashes of local accounts. The vulnerability does not affect configuration, enable, or debug commands. Password hashes disclosed can be attacked offline, potentially allowing administrative access if weak passwords are used. The issue is fixed in specific patched versions of Switch Engine.