CVE-2024-0004 CRITICAL

CVE-2024-0004

Vendor Purestorage
Product FlashArray
Weakness CWE-94 · Code injection
Published September 23, 2024
Last update September 24, 2024
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.

Key dates

02Disclosure timeline

September 23, 2024 CVE published
September 24, 2024 Record updated