PT-2023-5848 · Vmware+1 · Vsphere/Esxi+3

Published 2023-10-02 · Updated 2024-09-23 · CVE-2023-36628

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pure Storage VASA (affected versions not specified)

Description A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation. The issue is related to inadequate access control in the Pure Storage Purity flash storage management software.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2023-06535

CVE-2023-36628

Affected Products

Flasharray

Pure Storage Vasa

Purity

Vsphere/Esxi

References · 10

• https://support.purestorage.com/Pure_Storage_Technical_Services/Field_Bulletins/Security_Bulletins/Security_Bulletin_for_Privilege_Escalation_in_VASA_CVE-2023-36628 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06535 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36628 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36628 · Security Note
• https://twitter.com/VulmonFeeds/status/1709082749661778240 · Twitter Post
• https://twitter.com/vuldb/status/1709104765915852823 · Twitter Post
• https://twitter.com/CVEnew/status/1708986906032353521 · Twitter Post
• https://t.me/cibsecurity/71458 · Telegram Post
• https://t.me/cvenotify/95642 · Telegram Post
• https://vuldb.com/ru/?id.241081 · Note