CVE-2023-4976 (GCVE-0-2023-4976)

Vulnerability from cvelistv5 – Published: 2024-07-17 15:25 – Updated: 2025-04-10 14:18
VLAI
Title
FlashBlade Authentication Mechanism Vulnerability
Summary
A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array.
Severity
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-17 17:54 UTC
CWE
  • CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
Vendor Product Version CPE status
PureStorage FlashBlade Affected: 3.3.5 , ≤ 3.3.10 (custom)
Affected: 4.0.4 , ≤ 4.0.6 (custom)
Affected: 4.1.0 , ≤ 4.1.8 (custom)
Affected: 4.2.0 , ≤ 4.2.2 (custom)
guessed Create a notification for this product.
purestorage flashblade Affected: 3.3.5 , ≤ 3.3.10 (custom)
Affected: 4.0.4 , ≤ 4.0.6 (custom)
Affected: 4.1.0 , ≤ 4.1.8 (custom)
Affected: 4.2.0 , ≤ 4.2.2 (custom)
    cpe:2.3:a:purestorage:flashblade:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:purestorage:flashblade:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "flashblade",
            "vendor": "purestorage",
            "versions": [
              {
                "lessThanOrEqual": "3.3.10",
                "status": "affected",
                "version": "3.3.5",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "4.0.6",
                "status": "affected",
                "version": "4.0.4",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "4.1.8",
                "status": "affected",
                "version": "4.1.0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "4.2.2",
                "status": "affected",
                "version": "4.2.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-4976",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-17T17:54:56.371990Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-17T18:03:09.461Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:44:53.148Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://purestorage.com/security"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Purity//FB"
          ],
          "product": "FlashBlade",
          "vendor": "PureStorage",
          "versions": [
            {
              "lessThanOrEqual": "3.3.10",
              "status": "affected",
              "version": "3.3.5",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.0.6",
              "status": "affected",
              "version": "4.0.4",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.1.8",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.2.2",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eA flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-10T14:18:03.534Z",
        "orgId": "3895c224-4e1d-482a-adb3-fa64795683ac",
        "shortName": "PureStorage"
      },
      "references": [
        {
          "url": "https://www.purestorage.com/security"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis vulnerability can be fixed either by applying a patch or upgrading to an unaffected Purity version. \u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis issue is resolved in the following FlashBlade Purity versions:\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ePurity//FB 3.3.11 or later \u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ePurity//FB 4.1.9 or later \u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ePurity//FB 4.2.3 or later \u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ePurity//FB 4.3.0 or later \u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ePurity//FB 4.4.0 or later \u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "This vulnerability can be fixed either by applying a patch or upgrading to an unaffected Purity version. \n\nThis issue is resolved in the following FlashBlade Purity versions:\n\n\n  *  Purity//FB 3.3.11 or later \n\n\n\n\n  *  Purity//FB 4.1.9 or later \n\n\n\n\n  *  Purity//FB 4.2.3 or later \n\n\n\n\n  *  Purity//FB 4.3.0 or later \n\n\n\n\n  *  Purity//FB 4.4.0 or later"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "FlashBlade Authentication Mechanism Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3895c224-4e1d-482a-adb3-fa64795683ac",
    "assignerShortName": "PureStorage",
    "cveId": "CVE-2023-4976",
    "datePublished": "2024-07-17T15:25:58.472Z",
    "dateReserved": "2023-09-14T20:57:21.683Z",
    "dateUpdated": "2025-04-10T14:18:03.534Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-4976",
      "date": "2026-10-01",
      "epss": "0.00384",
      "percentile": "0.30043"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw exists in Purity//FB whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array."
        },
        {
          "lang": "es",
          "value": "Existe una falla en Purity//FB por la cual se permite que una cuenta local se autentique en la interfaz de administraci\u00f3n utilizando un m\u00e9todo no deseado que permite a un atacante obtener acceso privilegiado a la matriz."
        }
      ],
      "id": "CVE-2023-4976",
      "lastModified": "2024-11-21T08:36:23.163",
      "metrics": {
        "cvssMetricV40": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackRequirements": "NONE",
              "attackVector": "NETWORK",
              "automatable": "NOT_DEFINED",
              "availabilityRequirements": "NOT_DEFINED",
              "baseScore": 9.3,
              "baseSeverity": "CRITICAL",
              "confidentialityRequirements": "NOT_DEFINED",
              "exploitMaturity": "NOT_DEFINED",
              "integrityRequirements": "NOT_DEFINED",
              "modifiedAttackComplexity": "NOT_DEFINED",
              "modifiedAttackRequirements": "NOT_DEFINED",
              "modifiedAttackVector": "NOT_DEFINED",
              "modifiedPrivilegesRequired": "NOT_DEFINED",
              "modifiedSubsequentSystemAvailability": "NOT_DEFINED",
              "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED",
              "modifiedSubsequentSystemIntegrity": "NOT_DEFINED",
              "modifiedUserInteraction": "NOT_DEFINED",
              "modifiedVulnerableSystemAvailability": "NOT_DEFINED",
              "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED",
              "modifiedVulnerableSystemIntegrity": "NOT_DEFINED",
              "privilegesRequired": "NONE",
              "providerUrgency": "NOT_DEFINED",
              "recovery": "NOT_DEFINED",
              "safety": "NOT_DEFINED",
              "subsequentSystemAvailability": "NONE",
              "subsequentSystemConfidentiality": "NONE",
              "subsequentSystemIntegrity": "NONE",
              "userInteraction": "NONE",
              "valueDensity": "NOT_DEFINED",
              "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
              "version": "4.0",
              "vulnerabilityResponseEffort": "NOT_DEFINED",
              "vulnerableSystemAvailability": "HIGH",
              "vulnerableSystemConfidentiality": "HIGH",
              "vulnerableSystemIntegrity": "HIGH"
            },
            "source": "psirt@purestorage.com",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-07-17T16:15:03.233",
      "references": [
        {
          "source": "psirt@purestorage.com",
          "url": "https://purestorage.com/security"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://purestorage.com/security"
        }
      ],
      "sourceIdentifier": "psirt@purestorage.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-269"
            }
          ],
          "source": "psirt@purestorage.com",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "platforms": [
                  "Purity//FB"
                ],
                "product": "FlashBlade",
                "vendor": "PureStorage",
                "versions": [
                  {
                    "lessThanOrEqual": "3.3.10",
                    "status": "affected",
                    "version": "3.3.5",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "4.0.6",
                    "status": "affected",
                    "version": "4.0.4",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "4.1.8",
                    "status": "affected",
                    "version": "4.1.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "4.2.2",
                    "status": "affected",
                    "version": "4.2.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "psirt@purestorage.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:purestorage:flashblade:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "flashblade",
                "vendor": "purestorage",
                "versions": [
                  {
                    "lessThanOrEqual": "3.3.10",
                    "status": "affected",
                    "version": "3.3.5",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "4.0.6",
                    "status": "affected",
                    "version": "4.0.4",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "4.1.8",
                    "status": "affected",
                    "version": "4.1.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "4.2.2",
                    "status": "affected",
                    "version": "4.2.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array."
          },
          {
            "lang": "es",
            "value": "Existe una falla en Purity//FB por la cual se permite que una cuenta local se autentique en la interfaz de administraci\u00f3n utilizando un m\u00e9todo no deseado que permite a un atacante obtener acceso privilegiado a la matriz."
          }
        ],
        "id": "CVE-2023-4976",
        "lastModified": "2026-06-17T06:39:01.297",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "psirt@purestorage.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-4976",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-17T17:54:56.371990Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-07-17T16:15:03.233",
        "references": [
          {
            "source": "psirt@purestorage.com",
            "url": "https://www.purestorage.com/security"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://purestorage.com/security"
          }
        ],
        "sourceIdentifier": "psirt@purestorage.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-269"
              }
            ],
            "source": "psirt@purestorage.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T07:44:53.148Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://purestorage.com/security"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:purestorage:flashblade:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "flashblade",
                "vendor": "purestorage",
                "versions": [
                  {
                    "lessThanOrEqual": "3.3.10",
                    "status": "affected",
                    "version": "3.3.5",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "4.0.6",
                    "status": "affected",
                    "version": "4.0.4",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "4.1.8",
                    "status": "affected",
                    "version": "4.1.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "4.2.2",
                    "status": "affected",
                    "version": "4.2.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-4976",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-07-17T17:54:56.371990Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-07-17T18:03:02.579Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "platforms": [
                "Purity//FB"
              ],
              "product": "FlashBlade",
              "vendor": "PureStorage",
              "versions": [
                {
                  "lessThanOrEqual": "3.3.10",
                  "status": "affected",
                  "version": "3.3.5",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "4.0.6",
                  "status": "affected",
                  "version": "4.0.4",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "4.1.8",
                  "status": "affected",
                  "version": "4.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "4.2.2",
                  "status": "affected",
                  "version": "4.2.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cspan style=\"background-color: transparent;\"\u003eA flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array.\u003c/span\u003e\u003cbr\u003e"
                }
              ],
              "value": "A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-233",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-233 Privilege Escalation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-269",
                  "description": "CWE-269 Improper Privilege Management",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-04-10T14:18:03.534Z",
            "orgId": "3895c224-4e1d-482a-adb3-fa64795683ac",
            "shortName": "PureStorage"
          },
          "references": [
            {
              "url": "https://www.purestorage.com/security"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis vulnerability can be fixed either by applying a patch or upgrading to an unaffected Purity version. \u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis issue is resolved in the following FlashBlade Purity versions:\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ePurity//FB 3.3.11 or later \u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ePurity//FB 4.1.9 or later \u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ePurity//FB 4.2.3 or later \u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ePurity//FB 4.3.0 or later \u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ePurity//FB 4.4.0 or later \u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
                }
              ],
              "value": "This vulnerability can be fixed either by applying a patch or upgrading to an unaffected Purity version. \n\nThis issue is resolved in the following FlashBlade Purity versions:\n\n\n  *  Purity//FB 3.3.11 or later \n\n\n\n\n  *  Purity//FB 4.1.9 or later \n\n\n\n\n  *  Purity//FB 4.2.3 or later \n\n\n\n\n  *  Purity//FB 4.3.0 or later \n\n\n\n\n  *  Purity//FB 4.4.0 or later"
            }
          ],
          "source": {
            "discovery": "INTERNAL"
          },
          "title": "FlashBlade Authentication Mechanism Vulnerability",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "3895c224-4e1d-482a-adb3-fa64795683ac",
        "assignerShortName": "PureStorage",
        "cveId": "CVE-2023-4976",
        "datePublished": "2024-07-17T15:25:58.472Z",
        "dateReserved": "2023-09-14T20:57:21.683Z",
        "dateUpdated": "2025-04-10T14:18:03.534Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.