CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2019-17361
Critical (9.8). EPSS 15% chance of exploitation in the next 30 days. Fixed in salt 2019.2.1, 2019.2.3.
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
Severity
- EPSS
- 15% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
- CWE
- CWE-77
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- opensuse:leap
- saltstack:salt
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-q53j-p6r2-g2v4 | PyPI | salt | <2019.2.3 | 2019.2.3 |
| PYSEC-2020-177 | PyPI | salt | <2019.2.1 | 2019.2.1 |