CVE-2023-36628 Privilege Escalation in VASA

What is CVE-2023-36628?

CVE-2023-36628 is a high-severity vulnerability in Pure Storage FlashArray Purity, published on 2 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.

Weakness: CWE-269

Which versions are affected by CVE-2023-36628?

It affects 1 product.

Products include Purestorage Purity\/\/Fa.

How do I fix CVE-2023-36628?

No fix has been published for CVE-2023-36628 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-36628 being exploited?

There is no known exploitation of CVE-2023-36628 in the wild and no public exploit code.

Other vulnerabilities in Pure Storage FlashArray Purity

• CVE-2024-0001 Auth bypass in FlashArray Critical 10.0
• CVE-2024-0002 Auth bypass in FlashArray Critical 10.0
• CVE-2022-32554 Hardcoded credentials in n/a Critical 9.8
• CVE-2024-0003 Privilege escalation in FlashArray Critical 9.1
• CVE-2024-0004 Command injection in FlashArray Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c2xj-xc27-698r.