cve.bz

CVE-2020-28243

7.8 highEPSS 4.3%

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.

Severity

CVSS 3.1

7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
4.3% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
CWE
CWE-77
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-phhw-3wc9-8q75PyPIsalt<2015.8.132015.8.13
GHSA-phhw-3wc9-8q75PyPIsalt>=2016.3.0 <2016.11.52016.11.5
GHSA-phhw-3wc9-8q75PyPIsalt>=2016.11.7 <2016.11.102016.11.10
GHSA-phhw-3wc9-8q75PyPIsalt>=2017.5.0 <2017.7.82017.7.8
GHSA-phhw-3wc9-8q75PyPIsalt>=2018.2.0 <=2018.3.5no fix published
GHSA-phhw-3wc9-8q75PyPIsalt>=2019.2.0 <2019.2.82019.2.8
GHSA-phhw-3wc9-8q75PyPIsalt>=3000 <3000.73000.7
GHSA-phhw-3wc9-8q75PyPIsalt>=3001 <3001.53001.5
GHSA-phhw-3wc9-8q75PyPIsalt>=3002 <3002.33002.3
PYSEC-2021-73PyPIsalt<2015.8.10
>=2015.8.11 <2015.8.13
>=2016.3.0 <2016.3.4
>=2016.3.5 <2016.3.6
>=2016.3.7 <2016.3.8
>=2016.11.0 <2016.11.3
>=2016.11.4 <2016.11.5
>=2016.11.7 <2016.11.10
>=2017.7.0 <2017.7.8
>=2018.3.0rc1 <2019.2.0rc1
>=2019.2.0 <2019.2.5
>=2019.2.6 <2019.2.8
>=3000 <3000.6
>=3001 <3001.4
>=3002 <3002.5		2015.8.10, 2015.8.13, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.0rc1, 2019.2.5, 2019.2.8, 3000.6, 3001.4, 3002.5

References

Check your stackJSON