CVE-2022-32552

HIGH

8.8

CVSS Score

Published: June 22, 2022 at 02:22 PM UTC

Updated: June 17, 2026 at 04:47 AM UTC

2 products affected across 1 vendorPurity / /faPurity / /fb

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 1%

Description

Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 - 3.2.4, 3.1.0 - 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to a privilege escalation via the manipulation of Python environment variables which can be exploited by a logged-in user to escape a restricted shell to an unrestricted shell with root privileges. No other Pure Storage products or services are affected. Remediation is available from Pure Storage via a self-serve “opt-in” patch, manual patch application or a software upgrade to an unaffected version of Purity software.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Purity / /fa · Purestorage

95%

v < 5.3.186.0.0 ≤ v < 6.0.96.1.0 ≤ v < 6.1.136.2.0 ≤ v < 6.2.4

Affected range stops below 5.3.18, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.0.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.1.13, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.2.4, so it looks safe — our inference, not a vendor statement

Purity / /fb · Purestorage

95%

v < 3.1.133.2.0 ≤ v < 3.2.53.3.0 ≤ v < 3.3.1

Affected range stops below 3.1.13, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.2.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.3.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://support.purestorage.com/Pure_Security/Security_Bundle_2022-04-04/Security_Advisory_for_%E2%80%9Csecurity-bundle-2022-04-04

References (1)

x_refsource_MISCMitigationVendor Advisory

Source: [email protected]

https://support.purestorage.com/Pure_Security/Security_Bundle_2022-04-04/Security_Advisory_for_%E2%80%9Csecurity-bundle-2022-04-04

CVSS

8.8HIGH[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card