CRITICAL🇵🇱 Wersja polska

CVE-2024-0005

CVSS 9.1v3.1pub. 2024-09-23upd. 2024-09-27

A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Purestorage Purity\/\/fa

    APP
    Purestorage
    6.5.06.6.05.2.0 – 5.2.75.3.0 – 5.3.216.0.0 – 6.0.96.1.0 – 6.1.256.2.0 – 6.2.176.3.0 – 6.3.146.4.0 – 6.4.105.0.0 – 5.0.115.1.0 – 5.1.17

  • Purestorage Purity\/\/fb

    APP
    Purestorage
    4.3.04.3.13.2.0 – 3.2.103.3.0 – 3.3.113.0.0 – 3.0.94.1.0 – 4.1.104.2.0 – 4.2.34.0.0 – 4.0.63.1.0 – 3.1.5
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2024-0001CRITICAL10.0PL ✓ten sam produkt

FlashArray Purity — aktywne konto lokalne umożliwia privilege escalation

CVE-2024-0004CRITICAL9.1PL ✓ten sam produkt

Zdalne wykonanie kodu z eskalacją uprawnień w Pure Storage FlashArray Purity

CVE-2024-0003CRITICAL9.1PL ✓ten sam produkt

Pure Storage FlashArray Purity — nieautoryzowane tworzenie konta z uprawnieniami

CVE-2024-0002CRITICAL10.0PL ✓ten sam produkt

Obejście uwierzytelnienia w Pure Storage FlashArray Purity (CVSS 10.0)

CVE-2022-32554CRITICAL9.8ten sam produkt

Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3....