CVE Feed

    Dashboard / CVE / CVE-2024-0003

    CVE-2024-0003

    A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privileged access.

    Published:Sep 23, 2024
    Last Modified:Sep 27, 2024
    EPS:Sep 23, 2024
    EPSS Score:0.0021
    CVSS Score:9.1

    Affected Products

    Vendor
    Purestorage
    Product
    Flasharray
    Vendor
    Purestorage
    Product
    Purity\/\/fa

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-269 Improper Privilege Management

    Related CVEs

    CVE-2026-0209 (CVSS 6.9) — Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or la…
    CVE-2025-0051 (CVSS 8.7) — Improper input validation performed during the authentication process of FlashArray could lead to a system Den…
    CVE-2024-3057 (CVSS 9.8) — A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation.…
    CVE-2024-0005 (CVSS 9.1) — A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary comman…
    CVE-2024-0004 (CVSS 9.1) — A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands r…
    CVE-2024-0002 (CVSS 10) — A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote ac…
    CVE-2024-0001 (CVSS 10) — A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remai…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High