saltstack/salt · Security
Salt has insufficient argument validation in several modules
- GHSA ID
- GHSA-v89f-4mc4-h6w9
- CVE ID
- CVE-2013-4435
- Severity
- high
- Published
- Updated
- CVSS
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v4
- 7.7 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.
CWEs
- CWE-287 · Improper Authentication
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-4435 ↗
- http://docs.saltstack.com/topics/releases/0.17.1.html ↗
- http://www.openwall.com/lists/oss-security/2013/10/18/3 ↗
- https://github.com/saltstack/salt/blob/master/doc/topics/releases/0.17.1.rst ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2013-12.yaml ↗
- https://github.com/advisories/GHSA-v89f-4mc4-h6w9 ↗