CVE-2024-0002 - OpenCVE

A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Purestorage	Flasharray

No data.

No data.

References

Link	Providers
https://purestorage.com/security

History

Mon, 23 Sep 2024 18:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Purestorage Purestorage flasharray
CPEs		cpe:2.3:a:purestorage:flasharray:5.3.17:::::::* cpe:2.3:a:purestorage:flasharray:6.0.7:::::::* cpe:2.3:a:purestorage:flasharray:6.1.8:::::::* cpe:2.3:a:purestorage:flasharray:6.2.0:::::::* cpe:2.3:a:purestorage:flasharray:6.3.0:::::::* cpe:2.3:a:purestorage:flasharray:6.4.0:::::::* cpe:2.3:a:purestorage:flasharray:6.5.0:::::::*
Vendors & Products		Purestorage Purestorage flasharray
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 23 Sep 2024 17:45:00 +0000

Type	Values Removed	Values Added
Description		A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.
Weaknesses		CWE-287
References		https://purestorage.com/security
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: PureStorage

Published: 2024-09-23T17:26:08.811Z

Updated: 2024-09-23T18:04:46.783Z

Reserved: 2023-11-01T17:10:12.785Z

Link: CVE-2024-0002

Vulnrichment

Updated: 2024-09-23T18:04:18.882Z

NVD

Status : Received

Published: 2024-09-23T18:15:04.410

Modified: 2024-09-23T18:15:04.410

Link: CVE-2024-0002

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-0002", "assignerOrgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "state": "PUBLISHED", "assignerShortName": "PureStorage", "dateReserved": "2023-11-01T17:10:12.785Z", "datePublished": "2024-09-23T17:26:08.811Z", "dateUpdated": "2024-09-23T18:04:46.783Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Purity"], "product": "FlashArray", "vendor": "PureStorage", "versions": [{"lessThanOrEqual": "5.3.21", "status": "affected", "version": "5.3.17", "versionType": "custom"}, {"lessThanOrEqual": "6.1.25", "status": "affected", "version": "6.1.8", "versionType": "custom"}, {"lessThanOrEqual": "6.0.9", "status": "affected", "version": "6.0.7", "versionType": "custom"}, {"lessThanOrEqual": "6.2.17", "status": "affected", "version": "6.2.0", "versionType": "custom"}, {"lessThanOrEqual": "6.3.14", "status": "affected", "version": "6.3.0", "versionType": "custom"}, {"lessThanOrEqual": "6.4.10", "status": "affected", "version": "6.4.0", "versionType": "custom"}, {"status": "affected", "version": "6.5.0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.</span><br>"}], "value": "A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "shortName": "PureStorage", "dateUpdated": "2024-09-23T17:34:33.782Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://purestorage.com/security"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version.\n<br>\n<br>This issue is resolved in the following<span style=\"background-color: rgb(255, 255, 255);\"> FlashArray Purity </span> releases:\n<br><ul><li><span style=\"background-color: rgb(255, 255, 255);\">Purity//FA versions 6.3.15 or later </span></li><li><span style=\"background-color: rgb(255, 255, 255);\">Purity//FA versions 6.5.1 or later </span></li><li><span style=\"background-color: rgb(255, 255, 255);\">Purity//FA versions 6.6.1 or later.</span></li></ul>"}], "value": "Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version.\n\n\n\nThis issue is resolved in the following\u00a0FlashArray Purity releases:\n\n * Purity//FA versions 6.3.15 or later \n * Purity//FA versions 6.5.1 or later \n * Purity//FA versions 6.6.1 or later."}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "purestorage", "product": "flasharray", "cpes": ["cpe:2.3:a:purestorage:flasharray:6.5.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.5.0", "status": "affected"}]}, {"vendor": "purestorage", "product": "flasharray", "cpes": ["cpe:2.3:a:purestorage:flasharray:6.2.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.2.0", "status": "affected", "lessThanOrEqual": "6.2.17", "versionType": "custom"}]}, {"vendor": "purestorage", "product": "flasharray", "cpes": ["cpe:2.3:a:purestorage:flasharray:6.0.7:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.0.7", "status": "affected", "lessThanOrEqual": "6.0.9", "versionType": "custom"}]}, {"vendor": "purestorage", "product": "flasharray", "cpes": ["cpe:2.3:a:purestorage:flasharray:6.1.8:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.1.8", "status": "affected", "lessThanOrEqual": "6.1.25", "versionType": "custom"}]}, {"vendor": "purestorage", "product": "flasharray", "cpes": ["cpe:2.3:a:purestorage:flasharray:5.3.17:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "5.3.17", "status": "affected", "lessThanOrEqual": "5.3.21", "versionType": "custom"}]}, {"vendor": "purestorage", "product": "flasharray", "cpes": ["cpe:2.3:a:purestorage:flasharray:6.3.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.3.0", "status": "affected", "lessThanOrEqual": "6.3.14", "versionType": "custom"}]}, {"vendor": "purestorage", "product": "flasharray", "cpes": ["cpe:2.3:a:purestorage:flasharray:6.4.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.4.0", "status": "affected", "lessThanOrEqual": "6.4.10", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-23T17:59:14.131679Z", "id": "CVE-2024-0002", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-23T18:04:46.783Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-0002", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-23T17:59:14.131679Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:purestorage:flasharray:6.5.0:*:*:*:*:*:*:*"], "vendor": "purestorage", "product": "flasharray", "versions": [{"status": "affected", "version": "6.5.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:purestorage:flasharray:6.2.0:*:*:*:*:*:*:*"], "vendor": "purestorage", "product": "flasharray", "versions": [{"status": "affected", "version": "6.2.0", "versionType": "custom", "lessThanOrEqual": "6.2.17"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:purestorage:flasharray:6.0.7:*:*:*:*:*:*:*"], "vendor": "purestorage", "product": "flasharray", "versions": [{"status": "affected", "version": "6.0.7", "versionType": "custom", "lessThanOrEqual": "6.0.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:purestorage:flasharray:6.1.8:*:*:*:*:*:*:*"], "vendor": "purestorage", "product": "flasharray", "versions": [{"status": "affected", "version": "6.1.8", "versionType": "custom", "lessThanOrEqual": "6.1.25"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:purestorage:flasharray:5.3.17:*:*:*:*:*:*:*"], "vendor": "purestorage", "product": "flasharray", "versions": [{"status": "affected", "version": "5.3.17", "versionType": "custom", "lessThanOrEqual": "5.3.21"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:purestorage:flasharray:6.3.0:*:*:*:*:*:*:*"], "vendor": "purestorage", "product": "flasharray", "versions": [{"status": "affected", "version": "6.3.0", "versionType": "custom", "lessThanOrEqual": "6.3.14"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:purestorage:flasharray:6.4.0:*:*:*:*:*:*:*"], "vendor": "purestorage", "product": "flasharray", "versions": [{"status": "affected", "version": "6.4.0", "versionType": "custom", "lessThanOrEqual": "6.4.10"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-23T18:04:18.882Z"}}], "cna": {"source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PureStorage", "product": "FlashArray", "versions": [{"status": "affected", "version": "5.3.17", "versionType": "custom", "lessThanOrEqual": "5.3.21"}, {"status": "affected", "version": "6.1.8", "versionType": "custom", "lessThanOrEqual": "6.1.25"}, {"status": "affected", "version": "6.0.7", "versionType": "custom", "lessThanOrEqual": "6.0.9"}, {"status": "affected", "version": "6.2.0", "versionType": "custom", "lessThanOrEqual": "6.2.17"}, {"status": "affected", "version": "6.3.0", "versionType": "custom", "lessThanOrEqual": "6.3.14"}, {"status": "affected", "version": "6.4.0", "versionType": "custom", "lessThanOrEqual": "6.4.10"}, {"status": "affected", "version": "6.5.0", "versionType": "custom"}], "platforms": ["Purity"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version.\n\n\n\nThis issue is resolved in the following\u00a0FlashArray Purity releases:\n\n * Purity//FA versions 6.3.15 or later \n * Purity//FA versions 6.5.1 or later \n * Purity//FA versions 6.6.1 or later.", "supportingMedia": [{"type": "text/html", "value": "Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version.\n<br>\n<br>This issue is resolved in the following<span style=\"background-color: rgb(255, 255, 255);\"> FlashArray Purity </span> releases:\n<br><ul><li><span style=\"background-color: rgb(255, 255, 255);\">Purity//FA versions 6.3.15 or later </span></li><li><span style=\"background-color: rgb(255, 255, 255);\">Purity//FA versions 6.5.1 or later </span></li><li><span style=\"background-color: rgb(255, 255, 255);\">Purity//FA versions 6.6.1 or later.</span></li></ul>", "base64": false}]}], "references": [{"url": "https://purestorage.com/security", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "shortName": "PureStorage", "dateUpdated": "2024-09-23T17:34:33.782Z"}}}, "cveMetadata": {"cveId": "CVE-2024-0002", "state": "PUBLISHED", "dateUpdated": "2024-09-23T18:04:46.783Z", "dateReserved": "2023-11-01T17:10:12.785Z", "assignerOrgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "datePublished": "2024-09-23T17:26:08.811Z", "assignerShortName": "PureStorage"}, "dataVersion": "5.1"}