HTTP Methods Allowed (per directory) vulnerability is seen on Brocade switch
Applies to
- Brocade FC SAN switch
- Prior to FOS v9.2.2
Issue
- When a vulnerability scan is run for Brocade FC switches HTTP Methods Allowed (per directory) vulnerability is seen.
- As per vulnerability following HTTP methods are considered insecure:
PUT, DELETE, CONNECT, TRACE, HEAD
- These http methods are used for RestAPI.
- Supported Methods by Brocade switch for FOS REST API are DELETE, GET, HEAD, OPTIONS, PATCH, and POST methods.
- Disabling port 80 and disabling rest(
mgmtapp --disable rest protocol http) will not resolve the issue.
