Purestorage Purity Fa vulnerabilities

CVE-2022-32554 [CRITICAL] CVE-2022-32554: Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5. Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to possibly exposed credentials for accessing the product’s m

CVE-2024-0002 [CRITICAL] CWE-287 CVE-2024-0002: A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.

CVE-2024-0005 [HIGH] CWE-77 CVE-2024-0005: A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitr A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration.

CVE-2024-0001 [CRITICAL] CWE-1188 CVE-2024-0001: A condition exists in FlashArray Purity whereby a local account intended for initial array configura A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.

CVE-2022-32552 [HIGH] CVE-2022-32552: Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5. Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to a privilege escalation via the manipulation of Python environm

CVE-2022-32553 [HIGH] CVE-2022-32553: Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5. Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to a privilege escalation via the manipulation of environment var

CVE-2023-36628 [HIGH] CWE-269 CVE-2023-36628: A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.

CVE-2024-0004 [HIGH] CWE-94 CVE-2024-0004: A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.

CVE-2024-0003 [HIGH] CWE-269 CVE-2024-0003: A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative s A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privileged access.

CVE-2023-32572 [MEDIUM] CWE-284 CVE-2023-32572: A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can a A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection.

CVE-2023-28373 [LOW] CVE-2023-28373: A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key man A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode.