Purity//FB Flaw Allows Privileged Access to Array through Unintended Authentication Method
CVE-2023-4976

9.3CRITICAL

Key Information:

Vendor

Purestorage

Status
Flashblade
Vendor
CVE Published:
17 July 2024

What is CVE-2023-4976?

A vulnerability exists in the Purity software by Pure Storage that allows local accounts to authenticate to the management interface using an unintended method. This flaw can be exploited, granting attackers privileged access to the system, potentially compromising the integrity and confidentiality of data. It is essential for users of Purity to review their security practices and apply any available updates to mitigate this risk.

Affected Version(s)

FlashBlade Purity//FB 3.3.5 <= 3.3.10

FlashBlade Purity//FB 4.0.4 <= 4.0.6

FlashBlade Purity//FB 4.1.0 <= 4.1.8

References

https://www.purestorage.com/security

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.