GitHub Advisoryadvisory · PyPI

GHSA-x549-r7m8-gv63 SaltStack Salt Remote command execution and incorrect access control when using salt-api

CRITICAL Published 2022-05-13 Modified 2024-10-23 Official page ↗
Aliases
CVE-2018-15751
Ecosystem
PyPI
Packages
salt
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2024-04-22

Affected packages

• PyPI salt: >= 2017.7.0, < 2017.7.8 → fixed in 2017.7.8 • PyPI salt: >= 2018.3.0, < 2018.3.3 → fixed in 2018.3.3 • PyPI salt: >= 2016.11.0, < 2016.11.10 → fixed in 2016.11.10

Description

SaltStack Salt 2016.11.x before 2016.11.10, 2017.7.x before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).

Related

Alias · CVE (1)

  • CVE-2018-15751 SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References