GitHub Advisoryadvisory · PyPI

GHSA-pmj6-9f8c-8g2m Saltstack Salt Unauthenticated Arbitrary Code Execution

HIGH Published 2022-05-24 Modified 2025-04-09 Official page ↗
Aliases
CVE-2021-25315
Ecosystem
PyPI
Packages
salt
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287, CWE-303
Reviewed
2024-04-22

Affected packages

• PyPI salt: < 3002.2 → fixed in 3002.2

Description

A Incorrect Implementation of Authentication Algorithm vulnerability in of SUSE SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.

Related

Alias · CVE (1)

  • CVE-2021-25315 CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to… vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-303 Incorrect Implementation of Authentication Algorithm weakness

References