CVE-2023-28373

FlashArray SafeMode Immutable Vulnerability

Description

A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode.

Remediation

Solution:

This issue is resolved in FlashArray Purity (OE) versions 6.1.23 or later, 6.2.16 or later, 6.3.7 or later, 6.4.1 or later

4.4

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.04%

Vendor Advisory purestorage.com

Affected: Pure Storage FlashArray Purity

References

Link	Tags
https://support.purestorage.com/Employee_Handbooks/Technical_Services/PSIRT/Security_Bulletin_for_FlashArray_SafeMode_Immutable_Vulnerability_CVE-2023-28373	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2023-28373?: CVE-2023-28373 has been scored as a medium severity vulnerability.
How to fix CVE-2023-28373?: To fix CVE-2023-28373: This issue is resolved in FlashArray Purity (OE) versions 6.1.23 or later, 6.2.16 or later, 6.3.7 or later, 6.4.1 or later
Is CVE-2023-28373 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2023-28373 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-28373?: CVE-2023-28373 affects Pure Storage FlashArray Purity.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.