CVE-2024-0003

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privileged access.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-00047.2A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege CVE-2024-00058.8A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specific CVE-2024-00065.4Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database us CVE-2024-00074.8A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator CVE-2024-00088.8Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to CVE-2024-00096.3An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user w CVE-2024-00106.1A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execu CVE-2024-00116.1A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution o CVE-2024-00129.8An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web CVE-2024-00147.8In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead to CVE-2024-00157.8In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. CVE-2024-00165.3In multiple locations, there is a possible out of bounds read due to a missing bounds check. This could lead to paired device information di