CVSS 3.0
5.3 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2018-15750
Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.
Severity
- EPSS
- 4.3% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- saltstack:salt
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jx34-pppm-gjvr | PyPI | salt | >=2017.7.0 <2017.7.8 | 2017.7.8 |
| GHSA-jx34-pppm-gjvr | PyPI | salt | >=2018.3.0 <2018.3.3 | 2018.3.3 |
| GHSA-jx34-pppm-gjvr | PyPI | salt | >=2016.11.0 <2016.11.10 | 2016.11.10 |
| PYSEC-2018-29 | PyPI | salt | <2017.7.8 >=2018.3.0 <2018.3.3 | 2017.7.8, 2018.3.3 |
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html
- https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html
- https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html
- https://groups.google.com/d/msg/salt-users/L9xqcJ0UXxs/qgDj42obBQAJ
- https://groups.google.com/d/msg/salt-users/dimVF7rpphY/jn3Xv3MbBQAJ