Pure Storage FlashArray Purity (management interface privilege bypass): An authenticated low-privileged user reaches

Impact

An authenticated low-privileged user reaches functionality beyond their assigned privileges in the array management interface - horizontal and vertical RBAC bypass on the storage control plane.

Who can reach it

Authenticated low-privilege user of the Purity management interface.

What to do

Apply the Purity update per Pure's security bulletins; review array RBAC assignments afterwards.

References