PT-2022-21366 · Pure Storage · Pure Storage Flashblade+1

Published 2022-06-22 · Updated 2022-07-05 · CVE-2022-32554

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pure Storage FlashArray versions 5.2.x and prior, 5.3.0 through 5.3.17, 6.0.0 through 6.0.8, 6.1.0 through 6.1.12, 6.2.0 through 6.2.3 Pure Storage FlashBlade versions 3.0.x and prior, 3.1.0 through 3.1.12, 3.2.0 through 3.2.4, 3.3.0

Description The vulnerable software possibly exposes credentials for accessing the product's management interface. The password may be known outside Pure Storage and could be used on an affected system, if reachable, to execute arbitrary instructions with root privileges. No other Pure Storage products or services are affected.

Recommendations For Pure Storage FlashArray versions 5.2.x and prior, 5.3.0 through 5.3.17, 6.0.0 through 6.0.8, 6.1.0 through 6.1.12, 6.2.0 through 6.2.3, apply a self-serve "opt-in" patch, manually apply a patch, or upgrade to an unaffected version of Purity software. For Pure Storage FlashBlade versions 3.0.x and prior, 3.1.0 through 3.1.12, 3.2.0 through 3.2.4, 3.3.0, apply a self-serve "opt-in" patch, manually apply a patch, or upgrade to an unaffected version of Purity software.

Fix

Related Identifiers

CVE-2022-32554

Affected Products

Pure Storage Flasharray

Pure Storage Flashblade

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-32554 · Security Note
• https://support.purestorage.com/Pure_Security/Security_Bundle_2022-04-04/Security_Advisory_for_%E2%80%9Csecurity-bundle-2022-04-04 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32554 · Vendor Advisory
• https://t.me/cibsecurity/45003 · Telegram Post