CVE-2024-0004 - OpenCVE

A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Purestorage	Flasharray

No data.

No data.

References

Link	Providers
https://purestorage.com/security

History

Tue, 24 Sep 2024 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Purestorage Purestorage flasharray
CPEs		cpe:2.3:a:purestorage:flasharray:5.0.0:::::::* cpe:2.3:a:purestorage:flasharray:5.1.0:::::::* cpe:2.3:a:purestorage:flasharray:5.2.0:::::::* cpe:2.3:a:purestorage:flasharray:5.3.0:::::::* cpe:2.3:a:purestorage:flasharray:6.0.0:::::::* cpe:2.3:a:purestorage:flasharray:6.1.0:::::::* cpe:2.3:a:purestorage:flasharray:6.2.0:::::::* cpe:2.3:a:purestorage:flasharray:6.3.0:::::::* cpe:2.3:a:purestorage:flasharray:6.4.0:::::::* cpe:2.3:a:purestorage:flasharray:6.5.0:::::::*
Vendors & Products		Purestorage Purestorage flasharray
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 23 Sep 2024 17:45:00 +0000

Type	Values Removed	Values Added
Description		A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.
Weaknesses		CWE-94
References		https://purestorage.com/security
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: PureStorage

Published: 2024-09-23T17:28:53.664Z

Updated: 2024-09-24T13:37:36.931Z

Reserved: 2023-11-01T17:10:18.894Z

Link: CVE-2024-0004

Vulnrichment

Updated: 2024-09-24T13:31:07.968Z

NVD

Status : Received

Published: 2024-09-23T18:15:04.973

Modified: 2024-09-23T18:15:04.973

Link: CVE-2024-0004

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-0004", "assignerOrgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "state": "PUBLISHED", "assignerShortName": "PureStorage", "dateReserved": "2023-11-01T17:10:18.894Z", "datePublished": "2024-09-23T17:28:53.664Z", "dateUpdated": "2024-09-24T13:37:36.931Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Purity"], "product": "FlashArray", "vendor": "PureStorage", "versions": [{"lessThanOrEqual": "5.0.11", "status": "affected", "version": "5.0.0", "versionType": "custom"}, {"lessThanOrEqual": "5.1.17", "status": "affected", "version": "5.1.0", "versionType": "custom"}, {"lessThanOrEqual": "5.2.7", "status": "affected", "version": "5.2.0", "versionType": "custom"}, {"lessThanOrEqual": "5.3.21", "status": "affected", "version": "5.3.0", "versionType": "custom"}, {"lessThanOrEqual": "6.0.9", "status": "affected", "version": "6.0.0", "versionType": "custom"}, {"lessThanOrEqual": "6.1.25", "status": "affected", "version": "6.1.0", "versionType": "custom"}, {"lessThanOrEqual": "6.2.17", "status": "affected", "version": "6.2.0", "versionType": "custom"}, {"lessThanOrEqual": "6.3.14", "status": "affected", "version": "6.3.0", "versionType": "custom"}, {"lessThanOrEqual": "6.4.10", "status": "affected", "version": "6.4.0", "versionType": "custom"}, {"status": "affected", "version": "6.5.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array."}], "value": "A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "shortName": "PureStorage", "dateUpdated": "2024-09-23T17:34:21.283Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://purestorage.com/security"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version.\n<br>\n<br>This issue is resolved in the following<span style=\"background-color: rgb(255, 255, 255);\"> FlashArray Purity </span> releases:\n<br><ul><li><span style=\"background-color: rgb(255, 255, 255);\">Purity//FA versions 6.3.15 or later </span></li><li><span style=\"background-color: rgb(255, 255, 255);\">Purity//FA versions 6.5.1 or later </span></li><li><span style=\"background-color: rgb(255, 255, 255);\">Purity//FA versions 6.6.1 or later.</span></li></ul>"}], "value": "Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version.\n\n\n\nThis issue is resolved in the following\u00a0FlashArray Purity releases:\n\n * Purity//FA versions 6.3.15 or later \n * Purity//FA versions 6.5.1 or later \n * Purity//FA versions 6.6.1 or later."}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "purestorage", "product": "flasharray", "cpes": ["cpe:2.3:a:purestorage:flasharray:6.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:purestorage:flasharray:6.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:purestorage:flasharray:6.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:purestorage:flasharray:6.5.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.2.0", "status": "affected", "lessThanOrEqual": "6.2.17", "versionType": "custom"}, {"version": "6.3.0", "status": "affected", "lessThanOrEqual": "6.3.14", "versionType": "custom"}, {"version": "6.4.0", "status": "affected", "lessThanOrEqual": "6.4.10", "versionType": "custom"}, {"version": "6.5.0", "status": "affected"}]}, {"vendor": "purestorage", "product": "flasharray", "cpes": ["cpe:2.3:a:purestorage:flasharray:6.1.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.1.0", "status": "affected", "lessThanOrEqual": "6.1.25", "versionType": "custom"}]}, {"vendor": "purestorage", "product": "flasharray", "cpes": ["cpe:2.3:a:purestorage:flasharray:6.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.0.0", "status": "affected", "lessThanOrEqual": "6.0.9", "versionType": "custom"}]}, {"vendor": "purestorage", "product": "flasharray", "cpes": ["cpe:2.3:a:purestorage:flasharray:5.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "5.0.0", "status": "affected", "lessThanOrEqual": "5.0.11", "versionType": "custom"}]}, {"vendor": "purestorage", "product": "flasharray", "cpes": ["cpe:2.3:a:purestorage:flasharray:5.1.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "5.1.0", "status": "affected", "lessThanOrEqual": "5.1.17", "versionType": "custom"}]}, {"vendor": "purestorage", "product": "flasharray", "cpes": ["cpe:2.3:a:purestorage:flasharray:5.2.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "5.2.0", "status": "affected", "lessThanOrEqual": "5.2.7", "versionType": "custom"}]}, {"vendor": "purestorage", "product": "flasharray", "cpes": ["cpe:2.3:a:purestorage:flasharray:5.3.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "5.3.0", "status": "affected", "lessThanOrEqual": "5.3.21", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-24T13:29:32.579545Z", "id": "CVE-2024-0004", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T13:37:36.931Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-0004", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-24T13:29:32.579545Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:purestorage:flasharray:6.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:purestorage:flasharray:6.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:purestorage:flasharray:6.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:purestorage:flasharray:6.5.0:*:*:*:*:*:*:*"], "vendor": "purestorage", "product": "flasharray", "versions": [{"status": "affected", "version": "6.2.0", "versionType": "custom", "lessThanOrEqual": "6.2.17"}, {"status": "affected", "version": "6.3.0", "versionType": "custom", "lessThanOrEqual": "6.3.14"}, {"status": "affected", "version": "6.4.0", "versionType": "custom", "lessThanOrEqual": "6.4.10"}, {"status": "affected", "version": "6.5.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:purestorage:flasharray:6.1.0:*:*:*:*:*:*:*"], "vendor": "purestorage", "product": "flasharray", "versions": [{"status": "affected", "version": "6.1.0", "versionType": "custom", "lessThanOrEqual": "6.1.25"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:purestorage:flasharray:6.0.0:*:*:*:*:*:*:*"], "vendor": "purestorage", "product": "flasharray", "versions": [{"status": "affected", "version": "6.0.0", "versionType": "custom", "lessThanOrEqual": "6.0.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:purestorage:flasharray:5.0.0:*:*:*:*:*:*:*"], "vendor": "purestorage", "product": "flasharray", "versions": [{"status": "affected", "version": "5.0.0", "versionType": "custom", "lessThanOrEqual": "5.0.11"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:purestorage:flasharray:5.1.0:*:*:*:*:*:*:*"], "vendor": "purestorage", "product": "flasharray", "versions": [{"status": "affected", "version": "5.1.0", "versionType": "custom", "lessThanOrEqual": "5.1.17"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:purestorage:flasharray:5.2.0:*:*:*:*:*:*:*"], "vendor": "purestorage", "product": "flasharray", "versions": [{"status": "affected", "version": "5.2.0", "versionType": "custom", "lessThanOrEqual": "5.2.7"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:purestorage:flasharray:5.3.0:*:*:*:*:*:*:*"], "vendor": "purestorage", "product": "flasharray", "versions": [{"status": "affected", "version": "5.3.0", "versionType": "custom", "lessThanOrEqual": "5.3.21"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T13:31:07.968Z"}}], "cna": {"source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PureStorage", "product": "FlashArray", "versions": [{"status": "affected", "version": "5.0.0", "versionType": "custom", "lessThanOrEqual": "5.0.11"}, {"status": "affected", "version": "5.1.0", "versionType": "custom", "lessThanOrEqual": "5.1.17"}, {"status": "affected", "version": "5.2.0", "versionType": "custom", "lessThanOrEqual": "5.2.7"}, {"status": "affected", "version": "5.3.0", "versionType": "custom", "lessThanOrEqual": "5.3.21"}, {"status": "affected", "version": "6.0.0", "versionType": "custom", "lessThanOrEqual": "6.0.9"}, {"status": "affected", "version": "6.1.0", "versionType": "custom", "lessThanOrEqual": "6.1.25"}, {"status": "affected", "version": "6.2.0", "versionType": "custom", "lessThanOrEqual": "6.2.17"}, {"status": "affected", "version": "6.3.0", "versionType": "custom", "lessThanOrEqual": "6.3.14"}, {"status": "affected", "version": "6.4.0", "versionType": "custom", "lessThanOrEqual": "6.4.10"}, {"status": "affected", "version": "6.5.0"}], "platforms": ["Purity"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version.\n\n\n\nThis issue is resolved in the following\u00a0FlashArray Purity releases:\n\n * Purity//FA versions 6.3.15 or later \n * Purity//FA versions 6.5.1 or later \n * Purity//FA versions 6.6.1 or later.", "supportingMedia": [{"type": "text/html", "value": "Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version.\n<br>\n<br>This issue is resolved in the following<span style=\"background-color: rgb(255, 255, 255);\"> FlashArray Purity </span> releases:\n<br><ul><li><span style=\"background-color: rgb(255, 255, 255);\">Purity//FA versions 6.3.15 or later </span></li><li><span style=\"background-color: rgb(255, 255, 255);\">Purity//FA versions 6.5.1 or later </span></li><li><span style=\"background-color: rgb(255, 255, 255);\">Purity//FA versions 6.6.1 or later.</span></li></ul>", "base64": false}]}], "references": [{"url": "https://purestorage.com/security", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.", "supportingMedia": [{"type": "text/html", "value": "A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "shortName": "PureStorage", "dateUpdated": "2024-09-23T17:34:21.283Z"}}}, "cveMetadata": {"cveId": "CVE-2024-0004", "state": "PUBLISHED", "dateUpdated": "2024-09-24T13:37:36.931Z", "dateReserved": "2023-11-01T17:10:18.894Z", "assignerOrgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "datePublished": "2024-09-23T17:28:53.664Z", "assignerShortName": "PureStorage"}, "dataVersion": "5.1"}