cve.bz

CVE-2021-25282

9.1 criticalEPSS 92%

Critical (9.1). EPSS 92% chance of exploitation in the next 30 days. Fixed in salt 2015.8.10, 2015.8.13, 2016.11.10.

An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.

Severity

CVSS 3.1

9.1 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS
92% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE
CWE-22
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-76x4-x3p6-rpr9PyPIsalt<2015.8.132015.8.13
GHSA-76x4-x3p6-rpr9PyPIsalt>=2016.3.0 <2016.11.52016.11.5
GHSA-76x4-x3p6-rpr9PyPIsalt>=2016.11.7 <2016.11.102016.11.10
GHSA-76x4-x3p6-rpr9PyPIsalt>=2017.5.0 <2017.7.82017.7.8
GHSA-76x4-x3p6-rpr9PyPIsalt>=2018.2.0 <=2018.3.5no fix published
GHSA-76x4-x3p6-rpr9PyPIsalt>=2019.2.0 <2019.2.82019.2.8
GHSA-76x4-x3p6-rpr9PyPIsalt>=3000 <3000.73000.7
GHSA-76x4-x3p6-rpr9PyPIsalt>=3001 <3001.53001.5
GHSA-76x4-x3p6-rpr9PyPIsalt>=3002 <3002.33002.3
PYSEC-2021-51PyPIsalt<2015.8.10
>=2015.8.11 <2015.8.13
>=2016.3.0 <2016.3.4
>=2016.3.5 <2016.3.6
>=2016.3.7 <2016.3.8
>=2016.11.0 <2016.11.3
>=2016.11.4 <2016.11.5
>=2016.11.7 <2016.11.10
>=2017.7.0 <2017.7.8
>=2018.3.0rc1 <2019.2.0rc1
>=2019.2.0 <2019.2.5
>=2019.2.6 <2019.2.8
>=3000 <3000.6
>=3001 <3001.4
>=3002 <3002.5		2015.8.10, 2015.8.13, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.0rc1, 2019.2.5, 2019.2.8, 3000.6, 3001.4, 3002.5

References

Check your stackJSON