CVE-2024-0001(purestorage / purity\/\/fa)

CVE-2024-0001 | The setup key that stayed active A temporary key used to set up a building should not quietly remain usable after the work is done. In FlashArray Purity, a local account intended for initial array configuration remained active, potentially allowing a malicious actor to gain elevated privileges. The issue is the lifecycle of that setup account, not a claim that every storage account is insecure. The lesson: installation is not the end of security. Review temporary access, remove what is no longer needed, and follow vendor guidance for affected systems.

The record describes a local account intended for initial FlashArray Purity configuration that remained active, potentially enabling elevated privileges. Temporary access needs an explicit end point. Official record: https://github.com/CVEProject/cvelistV5/blob/main/cves/2024/0xxx/CVE-2024-0001.json