GitHub Advisoryadvisory · PyPI

GHSA-jx34-pppm-gjvr SaltStack Salt Directory Traversal vulnerability in salt-api

MEDIUM Published 2022-05-13 Modified 2024-10-23 Official page ↗
Aliases
CVE-2018-15750
Ecosystem
PyPI
Packages
salt
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2024-04-22

Affected packages

• PyPI salt: >= 2017.7.0, < 2017.7.8 → fixed in 2017.7.8 • PyPI salt: >= 2018.3.0, < 2018.3.3 → fixed in 2018.3.3 • PyPI salt: >= 2016.11.0, < 2016.11.10 → fixed in 2016.11.10

Description

Directory Traversal vulnerability in salt-api in SaltStack Salt 2016.11.x before 2016.11.10, 2017.7.x before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.

Related

Alias · CVE (1)

  • CVE-2018-15750 Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References