CVE-2024-3057 - Vulnerability Details - OpenCVE

A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00198.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Purestorage	Flasharray

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-31663	A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation.

Fixes

Solution

This issue is resolved in FlashArray Purity (OE) versions 6.6.6 and later.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://support.purestorage.com/category/m_pure_storage_product_security

History

Tue, 08 Oct 2024 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Purestorage Purestorage flasharray
CPEs		cpe:2.3:a:purestorage:flasharray::::::::
Vendors & Products		Purestorage Purestorage flasharray
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 08 Oct 2024 17:00:00 +0000

Type	Values Removed	Values Added
Description		A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation.
Weaknesses		CWE-269
References		https://support.purestorage.com/category/m_pure_storage_product_security
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: PureStorage

Published: 2024-10-08T16:50:09.594Z

Updated: 2025-04-10T14:19:42.166Z

Reserved: 2024-03-28T20:10:55.577Z

Link: CVE-2024-3057

Vulnrichment

Updated: 2024-10-08T17:20:29.723Z

NVD

Status : Awaiting Analysis

Published: 2024-10-08T17:15:53.770

Modified: 2024-10-10T12:56:30.817

Link: CVE-2024-3057

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-3057", "assignerOrgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "state": "PUBLISHED", "assignerShortName": "PureStorage", "dateReserved": "2024-03-28T20:10:55.577Z", "datePublished": "2024-10-08T16:50:09.594Z", "dateUpdated": "2025-04-10T14:19:42.166Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Purity//FA"], "product": "FlashArray", "vendor": "PureStorage", "versions": [{"lessThanOrEqual": "6.6.5", "status": "affected", "version": "6.6.2", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation.</span><br>"}], "value": "A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "shortName": "PureStorage", "dateUpdated": "2025-04-10T14:19:42.166Z"}, "references": [{"url": "https://support.purestorage.com/category/m_pure_storage_product_security"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">This issue is resolved in FlashArray Purity (OE) versions 6.6.6 and later.</span><br>"}], "value": "This issue is resolved in FlashArray Purity (OE) versions 6.6.6 and later."}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "purestorage", "product": "flasharray", "cpes": ["cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "6.6.2", "status": "affected", "lessThanOrEqual": "6.6.5", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-08T17:17:12.412481Z", "id": "CVE-2024-3057", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T17:20:36.658Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-3057", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-08T17:17:12.412481Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*"], "vendor": "purestorage", "product": "flasharray", "versions": [{"status": "affected", "version": "6.6.2", "versionType": "custom", "lessThanOrEqual": "6.6.5"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T17:20:29.723Z"}}], "cna": {"source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PureStorage", "product": "FlashArray", "versions": [{"status": "affected", "version": "6.6.2", "versionType": "custom", "lessThanOrEqual": "6.6.5"}], "platforms": ["Purity//FA"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "This issue is resolved in FlashArray Purity (OE) versions 6.6.6 and later.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">This issue is resolved in FlashArray Purity (OE) versions 6.6.6 and later.</span><br>", "base64": false}]}], "references": [{"url": "https://support.purestorage.com/category/m_pure_storage_product_security"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "shortName": "PureStorage", "dateUpdated": "2025-04-10T14:19:42.166Z"}}}, "cveMetadata": {"cveId": "CVE-2024-3057", "state": "PUBLISHED", "dateUpdated": "2025-04-10T14:19:42.166Z", "dateReserved": "2024-03-28T20:10:55.577Z", "assignerOrgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "datePublished": "2024-10-08T16:50:09.594Z", "assignerShortName": "PureStorage"}, "dataVersion": "5.1"}