Low severity · published Jan 30, 2017
CVE-2015-8034
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file
3.3
CVSS
0.4%
EPSS
No
On KEV
Description
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Salt · Saltstack
through 2015.8.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-8034
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-8034
www.securityfocus.com
http://www.securityfocus.com/bid/96390
Release Notes
https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html
More from Salt
9.8
CVE-2020-16846
SaltStack Salt Shell Injection Vulnerability
9.8
CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability
6.5
CVE-2020-11652
SaltStack Salt Path Traversal Vulnerability
9.8
CVE-2021-33226
Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file
9.8
CVE-2021-3197
An issue was discovered in SaltStack Salt before 3002.5