« Volver al listado

CVE-2024-0001

Estado: AnalizadaCrítica (9.8)—

A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Purestorage — Purity//fa

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-0001",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-0001",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-23T17:51:47.992533Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@purestorage.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@purestorage.com",
      "affectedData": [
        {
          "vendor": "Pure Storage",
          "product": "FlashArray",
          "versions": [
            {
              "status": "affected",
              "version": "6.3.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.3.14"
            },
            {
              "status": "affected",
              "version": "6.4.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.4.10"
            }
          ],
          "platforms": [
            "Purity"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:purestorage:flasharray:6.3.0:*:*:*:*:*:*:*"
          ],
          "vendor": "purestorage",
          "product": "flasharray",
          "versions": [
            {
              "status": "affected",
              "version": "6.3.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.3.14"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:purestorage:flasharray:6.4.0:*:*:*:*:*:*:*"
          ],
          "vendor": "purestorage",
          "product": "flasharray",
          "versions": [
            {
              "status": "affected",
              "version": "6.4.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.4.10"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-09-23T18:15:04.070",
  "references": [
    {
      "url": "https://purestorage.com/security",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@purestorage.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@purestorage.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges."
    },
    {
      "lang": "es",
      "value": "Existe una condición en FlashArray Purity por la cual una cuenta local destinada a la configuración inicial de la matriz permanece activa, lo que potencialmente permite que un actor malintencionado obtenga privilegios elevados."
    }
  ],
  "lastModified": "2026-06-17T06:52:34.403",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:purestorage:purity\\/\\/fa:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A81E5420-C4D6-42CD-93EB-0B0BCB01F918",
              "versionEndIncluding": "6.3.14",
              "versionStartIncluding": "6.3.0"
            },
            {
              "criteria": "cpe:2.3:a:purestorage:purity\\/\\/fa:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07C73EC4-5F8C-422B-971F-0C8445E72145",
              "versionEndIncluding": "6.4.10",
              "versionStartIncluding": "6.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@purestorage.com"
}