cve.bz

CVE-2021-25281

9.8 criticalEPSS 73%

Critical (9.8). EPSS 73% chance of exploitation in the next 30 days. Fixed in salt 2015.8.10, 2015.8.13, 2016.11.10.

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
73% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE
CWE-287
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-xxw3-765m-f37pPyPIsalt<2015.8.132015.8.13
GHSA-xxw3-765m-f37pPyPIsalt>=2016.3.0 <2016.11.52016.11.5
GHSA-xxw3-765m-f37pPyPIsalt>=2016.11.7 <2016.11.102016.11.10
GHSA-xxw3-765m-f37pPyPIsalt>=2017.5.0 <2017.7.82017.7.8
GHSA-xxw3-765m-f37pPyPIsalt>=2018.2.0 <=2018.3.5no fix published
GHSA-xxw3-765m-f37pPyPIsalt>=2019.2.0 <2019.2.82019.2.8
GHSA-xxw3-765m-f37pPyPIsalt>=3000 <3000.73000.7
GHSA-xxw3-765m-f37pPyPIsalt>=3001 <3001.53001.5
GHSA-xxw3-765m-f37pPyPIsalt>=3002 <3002.33002.3
PYSEC-2021-50PyPIsalt<2015.8.10
>=2015.8.11 <2015.8.13
>=2016.3.0 <2016.3.4
>=2016.3.5 <2016.3.6
>=2016.3.7 <2016.3.8
>=2016.11.0 <2016.11.3
>=2016.11.4 <2016.11.5
>=2016.11.7 <2016.11.10
>=2017.7.0 <2017.7.8
>=2018.3.0rc1 <2019.2.0rc1
>=2019.2.0 <2019.2.5
>=2019.2.6 <2019.2.8
>=3000 <3000.6
>=3001 <3001.4
>=3002 <3002.5		2015.8.10, 2015.8.13, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.0rc1, 2019.2.5, 2019.2.8, 3000.6, 3001.4, 3002.5

References

Check your stackJSON