GitHub Advisoryadvisory · PyPI
GHSA-v89f-4mc4-h6w9 Salt has insufficient argument validation in several modules
HIGH
Official page ↗
- Aliases
- CVE-2013-4435
- Ecosystem
- PyPI
- Packages
- salt
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-287
- Reviewed
- 2024-05-01
Affected packages
• PyPI salt: >= 0.15.0, < 0.17.1 → fixed in 0.17.1
Description
Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.
Related
Alias · CVE (1)
- CVE-2013-4435 Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute… vulnerability
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-4435 advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2013-12.yaml web
- https://github.com/saltstack/salt package
- https://github.com/saltstack/salt/blob/master/doc/topics/releases/0.17.1.rst web
- http://docs.saltstack.com/topics/releases/0.17.1.html web
- http://www.openwall.com/lists/oss-security/2013/10/18/3 web