saltstack/salt · Security
Directory creation by malicious user in saltstack
- GHSA ID
- GHSA-q27c-j6j9-53w3
- CVE ID
- CVE-2024-22231
- Severity
- medium
- Published
- Updated
- CVSS
- 5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
- CVSS v3
- 5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Description
Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master.
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')