saltstack vulnerabilities

Products

• salt 26
• salt 2015 2
• salt 2018 1
• salt 2019 1
• saltstack 1

Latest saltstack CVEs

Newest publication first · page 1 of 2

1. CVE-2020-11651 SaltStack Salt Unauthenticated Remote Code Execution

   Published 2020-04-30

   Critical·CVSS 9.8 EPSS 96.6% CISA KEV added 2021-11-03 Exploited in the wild Framework module Public exploit

   An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user...

2. CVE-2020-11652 SaltStack Salt is vulnerable Arbitrary Directory Access

   Published 2020-04-30

   Medium·CVSS 6.5 EPSS 86.4% CISA KEV added 2021-11-03 Exploited in the wild Framework module Public exploit

   An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

3. CVE-2019-17361 SaltStack Salt is vulnerable to command injection

   Published 2020-01-17

   Critical·CVSS 9.8

   In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.

4. CVE-2013-2228 SaltStack RSA Key Generation allows remote users to decrypt communications

   Published 2019-12-03

   High·CVSS 8.1

   SaltStack RSA Key Generation allows remote users to decrypt communications

5. CVE-2019-1010259 SaltStack Salt SQL Injection vulnerability in mysql.user_chpass function

   Published 2019-07-18

   Critical·CVSS 9.8

   SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: sp...

6. CVE-2018-15751 SaltStack Salt Remote command execution and incorrect access control when using salt-api

   Published 2018-10-24

   Critical·CVSS 9.8

   SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).

7. CVE-2018-15750 SaltStack Salt Directory Traversal vulnerability in salt-api

   Published 2018-10-24

   Medium·CVSS 5.3

   Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.

8. CVE-2017-7893 SaltStack Salt allows compromised salt-minions to impersonate the salt-master

   Published 2018-04-23

   Critical·CVSS 9.8

   In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.

9. CVE-2017-14695 SaltStack Salt Directory traversal vulnerability in minion id validation

   Published 2017-10-24

   Critical·CVSS 9.8

   Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exi...

10. CVE-2017-14696 SaltStack Salt Denial of Service via a crafted authentication request

    Published 2017-10-24

    High·CVSS 7.5

    SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.

11. CVE-2015-6918 salt leaks git usernames and passwords to the log

    Published 2017-10-10

    Medium·CVSS 6.3

    salt before 2015.5.5 leaks git usernames and passwords to the log.

12. CVE-2017-5192 SaltStack Salt Authentication Bypass when using the local_batch client from salt-api

    Published 2017-09-26

    High·CVSS 8.8

    When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

13. CVE-2017-5200 SaltStack Salt arbitrary command execution in Salt-api via ssh_client

    Published 2017-09-26

    High·CVSS 8.8

    Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client.

14. CVE-2015-4017 Salt vulnerable to Improper Certificate Validation

    Published 2017-08-25

    High·CVSS 7.5

    Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.

15. CVE-2017-12791 SaltStack Salt Directory traversal vulnerability in minion id validation

    Published 2017-08-23

    Critical·CVSS 9.8

    Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.

16. CVE-2015-6941 salt password information leaked in debug logs

    Published 2017-08-09

    Critical·CVSS 9.8

    win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.

17. CVE-2017-8109 SaltStack Salt Information Exposure

    Published 2017-04-25

    High·CVSS 7.8

    The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).

18. CVE-2015-1838 Salt improper handling of tmp files

    Published 2017-04-13

    Medium·CVSS 5.3

    modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

19. CVE-2015-1839 SaltStack has insecure /tmp file handling in salt/modules/chef.py

    Published 2017-04-13

    Medium·CVSS 5.3

    modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

20. CVE-2016-9639 Salt allows deleted minions to read or write to minions with the same id

    Published 2017-02-07

    Critical·CVSS 9.1

    Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.

21. CVE-2016-3176 Salt Insecure configuration of PAM external authentication service

    Published 2017-01-31

    Medium·CVSS 5.6

    Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.

22. CVE-2015-8034 Salt uses weak permissions on the cache data

    Published 2017-01-30

    Low·CVSS 3.3

    The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.

23. CVE-2016-1866 Salt Improper Access Control

    Published 2016-04-12

    High·CVSS 8.1

    Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.

24. CVE-2014-3563 SaltStack Salt Insecure Temporary File Creation

    Published 2014-08-22

    High·CVSS 7.2

    Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

25. CVE-2013-6617 SaltStack Privilege Escalation vulnerability

    Published 2013-11-05

    High·CVSS 10.0

    The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.