TI-2023-12919 Aliases CVE-2023-28373 GHSA-q6fq-998p-v8fc

FlashArray SafeMode Immutable Vulnerability

LOW 21Published 2023-10-02 · Updated 2024-09-23

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00524 44th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Pure Storage	FlashArray Purity	6.1.0 – 6.1.22; 6.2.0 – 6.2.15; 6.3.0 – 6.3.6; 6.4.0	—	No fix listed	CNA

FlashArray Purity VendorPure Storage Affected 6.1.0 – 6.1.22; 6.2.0 – 6.2.15; 6.3.0 – 6.3.6; 6.4.0 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:purestorage:purity\/\/fa::::::::	6.1.0 – 6.1.22; 6.2.0 – 6.2.15; 6.3.0 – 6.3.6	Vulnerable	Pure Storage
cpe:2.3:a:purestorage:purity\/\/fa:6.4.0:::::::*	6.4.0	Vulnerable	Pure Storage

cpe:2.3:a:purestorage:purity\/\/fa:*:*:*:*:*:*:*:* Versions 6.1.0 – 6.1.22; 6.2.0 – 6.2.15; 6.3.0 – 6.3.6 Vulnerable ·Pure Storage
cpe:2.3:a:purestorage:purity\/\/fa:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Pure Storage

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-28373
2026-10-03 Alias added: GHSA-q6fq-998p-v8fc

References

Advisory 1

https://support.purestorage.com/Employee_Handbooks/Technical_Services/PSIRT/Security_Bulletin_for_FlashArray_SafeMode_Immutable_Vulnerability_CVE-2023-28373

TI-2024-00002 Improper authentication in Pure Storage FlashArray CVSS 3.1CRITICAL 10.0
TI-2024-00001 A condition exists in FlashArray Purity whereby a local account intended for initial… CVSS 3.1CRITICAL 10.0
TI-2022-14185 Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0… CVSS 3.1CRITICAL 9.8
TI-2024-00005 Command injection in Pure Storage FlashArray CVSS 3.1CRITICAL 9.1
TI-2024-00004 Code injection in Pure Storage FlashArray CVSS 3.1CRITICAL 9.1
TI-2024-00003 Improper privilege management in Pure Storage FlashArray CVSS 3.1CRITICAL 9.1

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences