CVE-2023-28373 FlashArray SafeMode Immutable Vulnerability

What is CVE-2023-28373?

CVE-2023-28373 is a medium-severity denial of service vulnerability in Pure Storage FlashArray Purity, published on 2 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode.

Which versions are affected by CVE-2023-28373?

It affects 1 product.

Products include Purestorage Purity\/\/Fa.

How do I fix CVE-2023-28373?

No fix has been published for CVE-2023-28373 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-28373 being exploited?

There is no known exploitation of CVE-2023-28373 in the wild and no public exploit code.

Other vulnerabilities in Pure Storage FlashArray Purity

• CVE-2024-0001 Auth bypass in FlashArray Critical 10.0
• CVE-2024-0002 Auth bypass in FlashArray Critical 10.0
• CVE-2022-32554 Hardcoded credentials in n/a Critical 9.8
• CVE-2024-0003 Privilege escalation in FlashArray Critical 9.1
• CVE-2024-0004 Command injection in FlashArray Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q6fq-998p-v8fc.