CVE-2024-0005

Summary

A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration.

Affected Software

VendorProductVersion RangeStatus
PureStorageFlashArray5.0.0 <= 5.0.11affected
PureStorageFlashArray5.1.0 <= 5.1.17affected
PureStorageFlashArray5.2.0 <= 5.2.7affected
PureStorageFlashArray5.3.0 <= 5.3.21affected
PureStorageFlashArray6.0.0 <= 6.0.9affected
PureStorageFlashArray6.1.0 <= 6.1.25affected
PureStorageFlashArray6.2.0 <= 6.2.17affected
PureStorageFlashArray6.3.0 <= 6.3.14affected
PureStorageFlashArray6.4.0 <= 6.4.10affected
PureStorageFlashArray6.5.0affected
PureStorageFlashArray6.6.0affected
PureStorageFlashBlade3.0.0 <= 3.0.9affected
PureStorageFlashBlade3.1.0 <= 3.1.15affected
PureStorageFlashBlade3.2.0 <= 3.2.10affected
PureStorageFlashBlade3.3.0 <= 3.3.11affected
PureStorageFlashBlade4.0.0 <= 4.0.6affected
PureStorageFlashBlade4.1.0 <= 4.1.10affected
PureStorageFlashBlade4.2.0 <= 4.2.3affected
PureStorageFlashBlade4.3.0 <= 4.3.1affected

Weaknesses

  • CWE-77: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References