cve.bz

CVE-2021-22004

6.4 mediumEPSS 0.4%

Medium (6.4). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in salt 3003.3.

An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software.

Severity

CVSS 3.1

6.4 medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
CWE
CWE-362
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-xf37-qcvf-7m57PyPIsalt<3003.33003.3
PYSEC-2021-346PyPIsalt<3003.33003.3

References

Check your stackJSON