CVE-2023-4976

FlashBlade Authentication Mechanism Vulnerability

State: Published
Severity: 9.3 Critical
Published: Jul 17, 2024
Updated: Apr 10, 2025
Reserved: Sep 14, 2023

Description

A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	PureStorage

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
FlashBladePureStorage	3.3.5 through 3.3.10Affected 4.0.4 through 4.0.6Affected 4.1.0 through 4.1.8Affected 4.2.0 through 4.2.2Affected

References

https://www.purestorage.com/security
https://purestorage.com/security

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.