CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2018-15751
Critical (9.8) in saltstack salt. EPSS 4.9% chance of exploitation in the next 30 days. Fixed in salt 2016.11.10, 2017.7.8, 2018.3.3.
SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).
Severity
- EPSS
- 4.9% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- saltstack:salt
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-x549-r7m8-gv63 | PyPI | salt | >=2017.7.0 <2017.7.8 | 2017.7.8 |
| GHSA-x549-r7m8-gv63 | PyPI | salt | >=2018.3.0 <2018.3.3 | 2018.3.3 |
| GHSA-x549-r7m8-gv63 | PyPI | salt | >=2016.11.0 <2016.11.10 | 2016.11.10 |
| PYSEC-2018-30 | PyPI | salt | >=2018.3.0 <2018.3.3 <2017.7.8 | 2018.3.3, 2017.7.8 |
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html
- https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html
- https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html
- https://groups.google.com/d/msg/salt-users/L9xqcJ0UXxs/qgDj42obBQAJ
- https://groups.google.com/d/msg/salt-users/dimVF7rpphY/jn3Xv3MbBQAJ