CVE-2022-32554 Hardcoded credentials in n/a

What is CVE-2022-32554?

CVE-2022-32554 is a critical vulnerability in n/a, published on 22 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to possibly exposed credentials for accessing the product’s management interface. The password may be known outside Pure Storage and could be used on an affected system, if reachable, to execute arbitrary instructions with root privileges. No other Pure Storage products or services are affected. Remediation is available from Pure Storage via a self-serve “opt-in” patch, manual patch application or a software upgrade to an unaffected version of Purity software.

Which versions are affected by CVE-2022-32554?

It affects 2 products.

Products include Purestorage Purity\/\/Fa, Purestorage Purity\/\/Fb.

How do I fix CVE-2022-32554?

No fix has been published for CVE-2022-32554 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-32554 being exploited?

There is no known exploitation of CVE-2022-32554 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2024-0001 Auth bypass in FlashArray Critical 10.0
• CVE-2024-0002 Auth bypass in FlashArray Critical 10.0
• CVE-2024-0003 Privilege escalation in FlashArray Critical 9.1
• CVE-2024-0004 Command injection in FlashArray Critical 9.1
• CVE-2024-0005 Command injection in FlashArray Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wxc4-vchh-4j9x.