CVEvulnerability

CVE-2020-11652

6.5 MEDIUM Known exploited Published 2020-04-30 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

SaltStack Salt Path Traversal Vulnerability — SaltStack Salt

SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.

Added to KEV
2021-11-03
Remediation due
2022-05-03
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2020-11652
Status
Analyzed
Published
2020-04-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-22

Description

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

Affected configurations

• saltstack salt (< 2019.2.4) • saltstack salt (>= 3000 < 3000.2) • opensuse leap 15.1 • debian debian linux 8.0 • debian debian linux 9.0 • debian debian linux 10.0 • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • blackberry workspaces server (<= 7.1.3) • blackberry workspaces server (>= 8.0.0 <= 8.2.6) • blackberry workspaces server 9.1.0 • vmware application remote collector 7.5.0 • vmware application remote collector 8.0.0

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References