CVE-2022-32552

published 2022-06-23

CVE-2022-32552: Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure…

Priority P3 52 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to a privilege escalation via the manipulation of Python environment variables which can be exploited by a logged-in user to escape a restricted shell to an unrestricted shell with root privileges. No other Pure Storage products or services are affected. Remediation is available from Pure Storage via a self-serve “opt-in” patch, manual patch application or a software upgrade to an unaffected version of Purity software.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
purestorage	purity_fa	< 5.3.18	5.3.18
purestorage	purity_fa	>= 6.0.0 < 6.0.9	6.0.9
purestorage	purity_fa	>= 6.1.0 < 6.1.13	6.1.13
purestorage	purity_fa	>= 6.2.0 < 6.2.4	6.2.4
purestorage	purity_fb	< 3.1.13	3.1.13
purestorage	purity_fb	>= 3.2.0 < 3.2.5	3.2.5
purestorage	purity_fb	>= 3.3.0 < 3.3.1	3.3.1

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.