CVE-2024-0004

Published Sep 23, 2024 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Description
A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.

Remediation

Vendor Solution

Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version. This issue is resolved in the following FlashArray Purity releases: * Purity//FA versions 6.3.15 or later * Purity//FA versions 6.5.1 or later * Purity//FA versions 6.6.1 or later.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-15807 A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.
References
History
Type Values Removed Values Added
First Time appeared Purestorage purity\/\/fa
CPEs cpe:2.3:a:purestorage:purity\/\/fa:*:*:*:*:*:*:*:*
cpe:2.3:a:purestorage:purity\/\/fa:6.5.0:*:*:*:*:*:*:*
Vendors & Products Purestorage purity\/\/fa
Type Values Removed Values Added
First Time appeared Purestorage
Purestorage flasharray
CPEs cpe:2.3:a:purestorage:flasharray:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:purestorage:flasharray:5.1.0:*:*:*:*:*:*:*
cpe:2.3:a:purestorage:flasharray:5.2.0:*:*:*:*:*:*:*
cpe:2.3:a:purestorage:flasharray:5.3.0:*:*:*:*:*:*:*
cpe:2.3:a:purestorage:flasharray:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:purestorage:flasharray:6.1.0:*:*:*:*:*:*:*
cpe:2.3:a:purestorage:flasharray:6.2.0:*:*:*:*:*:*:*
cpe:2.3:a:purestorage:flasharray:6.3.0:*:*:*:*:*:*:*
cpe:2.3:a:purestorage:flasharray:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:purestorage:flasharray:6.5.0:*:*:*:*:*:*:*
Vendors & Products Purestorage
Purestorage flasharray
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
PureStorage
Published
Updated
Sep 24, 2024, 1:37 PM
Reserved
Nov 1, 2023, 5:10 PM
Status
Analyzed
Published
Sep 23, 2024, 6:15 PM
Modified
Jun 17, 2026, 6:52 AM