« Volver al listado

CVE-2023-4976

Estado: AplazadaCrítica (9.3)—

A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Purestorage — FlashbladeAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-4976",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-4976",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-17T17:54:56.371990Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "psirt@purestorage.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@purestorage.com",
      "affectedData": [
        {
          "vendor": "PureStorage",
          "product": "FlashBlade",
          "versions": [
            {
              "status": "affected",
              "version": "3.3.5",
              "versionType": "custom",
              "lessThanOrEqual": "3.3.10"
            },
            {
              "status": "affected",
              "version": "4.0.4",
              "versionType": "custom",
              "lessThanOrEqual": "4.0.6"
            },
            {
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.1.8"
            },
            {
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.2.2"
            }
          ],
          "platforms": [
            "Purity//FB"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:purestorage:flashblade:*:*:*:*:*:*:*:*"
          ],
          "vendor": "purestorage",
          "product": "flashblade",
          "versions": [
            {
              "status": "affected",
              "version": "3.3.5",
              "versionType": "custom",
              "lessThanOrEqual": "3.3.10"
            },
            {
              "status": "affected",
              "version": "4.0.4",
              "versionType": "custom",
              "lessThanOrEqual": "4.0.6"
            },
            {
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.1.8"
            },
            {
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.2.2"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-07-17T16:15:03.233",
  "references": [
    {
      "url": "https://www.purestorage.com/security",
      "source": "psirt@purestorage.com"
    },
    {
      "url": "https://purestorage.com/security",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@purestorage.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array."
    },
    {
      "lang": "es",
      "value": "Existe una falla en Purity//FB por la cual se permite que una cuenta local se autentique en la interfaz de administración utilizando un método no deseado que permite a un atacante obtener acceso privilegiado a la matriz."
    }
  ],
  "lastModified": "2026-06-17T06:39:01.297",
  "sourceIdentifier": "psirt@purestorage.com"
}