Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2023-4976

FlashBlade Authentication Mechanism Vulnerability

Description

A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array.

Timeline

  1. ID reserved

    By PureStorage

  2. · 10 months later

    Published

  3. · 9 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2023-4976, by who scored it
Scored byCVSSScoreVector
PureStorageCNA (assigner)4.0Critical9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
NVDNVD · Deferred4.0Critical9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.38% · top 67% of all CVEs (12 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Affected products

  • PureStorage · FlashBlade

    • affected 3.3.5 – ≤ 3.3.10
    • affected 4.0.4 – ≤ 4.0.6
    • affected 4.1.0 – ≤ 4.1.8
    • affected 4.2.0 – ≤ 4.2.2

What to do

Solution: This vulnerability can be fixed either by applying a patch or upgrading to an unaffected Purity version. This issue is resolved in the following FlashBlade Purity versions: * Purity//FB 3.3.11 or later * Purity//FB 4.1.9 or later * Purity//FB 4.2.3 or later * Purity//FB 4.3.0 or later * Purity//FB 4.4.0 or later

References

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2023-4976 badge
[![CVE-2023-4976](https://cveledger.app/badge/CVE-2023-4976.svg)](https://cveledger.app/cve/CVE-2023-4976)

Record last updated .