Vulnerabilities > CVE-2024-0001 - Insecure Default Initialization of Resource vulnerability in Purestorage Purity//Fa

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

purestorage

CWE-1188

critical

NVD

Published: 2024-09-23

Updated: 2024-09-27

Summary

A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.

Vulnerable Configurations

Part	Description	Count
Application	Purestorage Purestorage Purity//Fa 6.4.0 Purestorage Purity//Fa 6.4.1 Purestorage Purity//Fa 6.4.2 Purestorage Purity//Fa 6.4.3 Purestorage Purity//Fa 6.4.4 Purestorage Purity//Fa 6.4.5 Purestorage Purity//Fa 6.4.7 Purestorage Purity//Fa 6.4.9 Purestorage Purity//Fa 6.4.10 Purestorage Purity//Fa 6.3.0 Purestorage Purity//Fa 6.3.1 Purestorage Purity//Fa 6.3.2 Purestorage Purity//Fa 6.3.3 Purestorage Purity//Fa 6.3.4 Purestorage Purity//Fa 6.3.5 Purestorage Purity//Fa 6.3.6 Purestorage Purity//Fa 6.3.7 Purestorage Purity//Fa 6.3.8 Purestorage Purity//Fa 6.3.9 Purestorage Purity//Fa 6.3.10 Purestorage Purity//Fa 6.3.11 Purestorage Purity//Fa 6.3.12 Purestorage Purity//Fa 6.3.13 Purestorage Purity//Fa 6.3.14	24

Common Weakness Enumeration (CWE)

CWE-1188 - Insecure Default Initialization of Resource

References

https://purestorage.com/security