CVE-2022-32554

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to possibly exposed credentials for accessing the product’s management interface. The password may be known outside Pure Storage and could be used on an affected system, if reachable, to execute arbitrary instructions with root privileges. No other Pure Storage products or services are affected. Remediation is available from Pure Storage via a self-serve “opt-in” patch, manual patch application or a software upgrade to an unaffected version of Purity software.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Jun 23, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-325558.8Unisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authenticate the POST requesCVE-2022-325567.5An issue was discovered in Couchbase Server before 7.0.4. A private key is leaked to the log files with certain crashes.CVE-2022-325577.5An issue was discovered in Couchbase Server before 7.0.4. The Index Service does not enforce authentication for TCP/TLS servers.CVE-2022-325587.5An issue was discovered in Couchbase Server before 7.0.4. Sample bucket loading may leak internal user passwords during a failure.CVE-2022-325599.1An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics.CVE-2022-32567.8Use After Free in GitHub repository vim/vim prior to 9.0.0530.CVE-2022-325607.5An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings.CVE-2022-325614.9An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4. Previous mitigations for CVE-2018-15728 were found to be insuCVE-2022-325628.8An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission.CVE-2022-325639.8An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate aCVE-2022-325647.5An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the Cluster Manager cookie.CVE-2022-325657.5An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids.
CVE-2022-32554: Critical severity, CVSS 9.8 | Vulnix