CVE-2024-0004

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
PureStorageFlashArray>= 5.0.0, <= 5.0.11; >= 5.1.0, <= 5.1.17; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.21; >= 6.0.0, <= 6.0.9; >= 6.1.0, <= 6.1.25; >= 6.2.0, <= 6.2.17; >= 6.3.0, <= 6.3.14; >= 6.4.0, <= 6.4.10; 6.5.0
purestorageflasharray>= 6.2.0, <= 6.2.17; >= 6.3.0, <= 6.3.14; >= 6.4.0, <= 6.4.10; 6.5.0
purestorageflasharray>= 6.1.0, <= 6.1.25
purestorageflasharray>= 6.0.0, <= 6.0.9
purestorageflasharray>= 5.0.0, <= 5.0.11
purestorageflasharray>= 5.1.0, <= 5.1.17
purestorageflasharray>= 5.2.0, <= 5.2.7
purestorageflasharray>= 5.3.0, <= 5.3.21

References

Timeline

Published
Sep 23, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-00058.8A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specificCVE-2024-00065.4Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database usCVE-2024-00074.8A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator CVE-2024-00088.8Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible toCVE-2024-00096.3An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user wCVE-2024-00106.1A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execuCVE-2024-00116.1A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution oCVE-2024-00129.8An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management webCVE-2024-00147.8In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead toCVE-2024-00157.8In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. CVE-2024-00165.3In multiple locations, there is a possible out of bounds read due to a missing bounds check. This could lead to paired device information diCVE-2024-00175.5In shouldUseNoOpLocation of CameraActivity.java, there is a possible confused deputy due to a permissions bypass. This could lead to local i
CVE-2024-0004: High severity, CVSS 7.2 | Vulnix