CVE-2024-0004

Summary

A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.

Affected Software

VendorProductVersion RangeStatus
PureStorageFlashArray5.0.0 <= 5.0.11affected
PureStorageFlashArray5.1.0 <= 5.1.17affected
PureStorageFlashArray5.2.0 <= 5.2.7affected
PureStorageFlashArray5.3.0 <= 5.3.21affected
PureStorageFlashArray6.0.0 <= 6.0.9affected
PureStorageFlashArray6.1.0 <= 6.1.25affected
PureStorageFlashArray6.2.0 <= 6.2.17affected
PureStorageFlashArray6.3.0 <= 6.3.14affected
PureStorageFlashArray6.4.0 <= 6.4.10affected
PureStorageFlashArray6.5.0affected

Weaknesses

  • CWE-94: CWE-94 Improper Control of Generation of Code ('Code Injection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References