CVE-2022-32553 Privilege escalation in n/a
A logged-in user can escape a restricted shell to gain root privileges by manipulating environment variables in Pure Storage FlashArray and FlashBlade products.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-32553?
CVE-2022-32553 is a high-severity vulnerability in n/a, published on 22 Jun 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to a privilege escalation via the manipulation of environment variables which can be exploited by a logged-in user to escape a restricted shell to an unrestricted shell with root privileges. No other Pure Storage products or services are affected. Remediation is available from Pure Storage via a self-serve “opt-in” patch, manual patch application or a software upgrade to an unaffected version of Purity software.
Which versions are affected by CVE-2022-32553?
It affects 2 products.
Products include Purestorage Purity\/\/Fa, Purestorage Purity\/\/Fb.
How do I fix CVE-2022-32553?
No fix has been published for CVE-2022-32553 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-32553 being exploited?
There is no known exploitation of CVE-2022-32553 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-gq4q-mq62-jxwm.