PureStorage vulnerabilities
We track 6 vulnerabilities in PureStorage products across 5 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 23, 2024.
Latest PureStorage vulnerabilities
- 8.8 High severity
FlashArray: Improper Neutralization of Special Elements used in a Command
A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration.
- 7.2 High severity
FlashArray: Improper Control of Generation of Code
A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.
- 7.2 High severity
FlashArray: Improper Privilege Management
A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privileged access.
- 9.8 Critical severity
FlashArray: Initialization of a Resource with an Insecure Default
A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.
- 9.3 Critical severity
FlashBlade: Improper Privilege Management
A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array.
- 9.3 Critical severity
Pure Swagger: Improper Limitation of a Pathname to a Restricted Directory
The PureStorage-OpenConnect/swagger repository through 1.1.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.