PT-2023-21679 · Pure Storage · Flashblade Purity

Published 2023-10-02 · Updated 2024-09-20 · CVE-2023-28372

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions FlashBlade Purity (OE) version 4.1.0

Description A flaw exists in FlashBlade Purity (OE) whereby a user with privileges to extend an object's retention period can affect the availability of the object lock.

Recommendations For version 4.1.0, consider restricting privileges to extend an object's retention period to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-28372

Affected Products

Flashblade Purity

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-28372 · Security Note
• https://support.purestorage.com/Pure_Storage_Technical_Services/Field_Bulletins/Security_Bulletins/Security_Bulletin_for_FlashBlade_Object_Store_Privileged_Access_Vulnerability_CVE-2023-28372 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28372 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1709005658161287291 · Twitter Post
• https://t.me/cvenotify/95440 · Telegram Post
• https://t.me/cibsecurity/71447 · Telegram Post