Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

saltstack salt 2016.11.3 vulnerabilities and exploits

(subscribe to this query)
7.8
CVSSv3
CVE-2017-8109
The salt-ssh minion code in SaltStack Salt 2016.11 prior to 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).
Saltstack Salt 2016.11.2Saltstack Salt 2016.11.0Saltstack Salt 2016.11Saltstack Salt 2016.11.1Saltstack Salt 2016.11.3
9.8
CVSSv3
CVE-2017-14695
Directory traversal vulnerability in minion id validation in SaltStack Salt prior to 2016.3.8, 2016.11.x prior to 2016.11.8, and 2017.7.x prior to 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerabili...
Saltstack Salt 2016.11.0Saltstack Salt 2016.11Saltstack SaltSaltstack Salt 2017.7.0Saltstack Salt 2016.11.2Saltstack Salt 2016.11.1Saltstack Salt 2016.11.7Saltstack Salt 2016.11.6Saltstack Salt 2016.11.5Saltstack Salt 2016.11.4Saltstack Salt 2017.7.1Saltstack Salt 2016.11.3
7.5
CVSSv3
CVE-2017-14696
SaltStack Salt prior to 2016.3.8, 2016.11.x prior to 2016.11.8, and 2017.7.x prior to 2017.7.2 allows remote malicious users to cause a denial of service via a crafted authentication request.
Saltstack SaltSaltstack Salt 2016.11Saltstack Salt 2016.11.0Saltstack Salt 2016.11.1Saltstack Salt 2016.11.2Saltstack Salt 2017.7.0Saltstack Salt 2016.11.4Saltstack Salt 2016.11.5Saltstack Salt 2016.11.6Saltstack Salt 2016.11.7Saltstack Salt 2016.11.3Saltstack Salt 2017.7.1
9.8
CVSSv3
CVE-2020-16846
An issue exists in SaltStack Salt up to and including 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
Saltstack Salt 3001Saltstack SaltDebian Debian Linux 9.0Debian Debian Linux 10.0
9.8
CVSSv3
CVE-2021-25281
An issue exists in through SaltStack Salt prior to 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
Saltstack SaltFedoraproject Fedora 32Fedoraproject Fedora 33Fedoraproject Fedora 34Debian Debian Linux 9.0Debian Debian Linux 10.0Debian Debian Linux 11.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-4761command injectionCVE-2024-3676IDORCVE-2024-30039CVE-2024-32113CVE-2024-30049CVE-2024-4776SQL injection
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook