CVE-2024-0004: Code Injection
Published Sep 23, 2024
·Updated
A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.
Affected Software
10 affected components
PureStorage Purity\/\/fa>=5.0.0<=5.0.11
PureStorage Purity\/\/fa>=5.1.0<=5.1.17
PureStorage Purity\/\/fa>=5.2.0<=5.2.7
PureStorage Purity\/\/fa>=5.3.0<=5.3.21
PureStorage Purity\/\/fa>=6.0.0<=6.0.9
PureStorage Purity\/\/fa>=6.1.0<=6.1.25
PureStorage Purity\/\/fa>=6.2.0<=6.2.17
PureStorage Purity\/\/fa>=6.3.0<=6.3.14
PureStorage Purity\/\/fa>=6.4.0<=6.4.10
PureStorage Purity\/\/fa=6.5.0
Remediation
Information
Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version.
This issue is resolved in the following FlashArray Purity releases:
* Purity//FA versions 6.3.15 or later
* Purity//FA versions 6.5.1 or later
* Purity//FA versions 6.6.1 or later.
Event History
Sep 23, 2024
CVE Published
via MITRE·05:28 PM
Data Sourced
via MITRE·05:28 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-0004?
CVE-2024-0004 has been classified as a critical severity vulnerability.
2
How do I fix CVE-2024-0004?
To fix CVE-2024-0004, apply the security patches provided by Pure Storage for affected Purity versions.
3
What versions of Pure Storage Purity are affected by CVE-2024-0004?
CVE-2024-0004 affects Pure Storage Purity versions from 5.0.0 to 6.5.0.
4
How does CVE-2024-0004 affect my security posture?
CVE-2024-0004 allows an attacker with administrative privileges to execute arbitrary commands, potentially leading to privilege escalation.
5
Is there a workaround for CVE-2024-0004?
Currently, there are no documented workarounds for CVE-2024-0004, and updating to the patched version is recommended.