SA
Product
Salt
On CISA KEVExploited in the wild
52
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 16High 17Medium 10Low 2
Watch
Add Salt to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-22967 | 8.8 | Jun 23 | An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2 Affected: before 3002.9; 3003 before 3003.5; 3004 before 3004.2 |
| CVE-2022-22941 | 8.8 | Mar 29 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1 Affected: 3002 before 3002.8; 3003 before 3003.4; 3004 before 3004.1 |
| CVE-2022-22936 | 8.8 | Mar 29 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1 Affected: 3002 before 3002.8; 3003 before 3003.4; 3004 before 3004.1 |
| CVE-2022-22934 | 8.8 | Mar 29 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1 Affected: 3002 before 3002.8; 3003 before 3003.4; 3004 before 3004.1 |
| CVE-2017-5200 | 8.8 | Sep 26 | Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client Affected: through 2015.8.12; 2016.3.0; 2016.3.1; 2016.3.2; 2016.3.3; 2016.3.4; +3 more |
| CVE-2017-5192 | 8.8 | Sep 26 | When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not… Affected: through 2015.8.12; 2016.3.0; 2016.3.1; 2016.3.2; 2016.3.3; 2016.3.4; +3 more |
| CVE-2016-1866 | 8.1 | Apr 12 | Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into… Affected: 2015.8.0; 2015.8.1; 2015.8.2; 2015.8.3 |
| CVE-2023-20898 | 7.8 | Sep 5 | Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2 Affected: before 3005.2; 3006.0 before 3006.2 |
| CVE-2021-31607 | 7.8 | Apr 23 | In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion Affected: 2016.9 through 3002.6 |
| CVE-2021-25315 | 7.8 | Mar 3 | CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without… Affected: before 3002.2 |
| CVE-2020-28243 | 7.8 | Feb 27 | An issue was discovered in SaltStack Salt before 3002.5 Affected: before 2015.8.10; 2015.8.11 before 2015.8.13; 2016.3.0 before 2016.3.4; 2016.3.5 before 2016.3.6; 2016.3.7 before 2016.3.8; 2016.3.9 before 2016.11.3; +9 more |
| CVE-2017-8109 | 7.8 | Apr 25 | The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to… Affected: 2016.11; 2016.11.0; 2016.11.0; 2016.11.0; 2016.11.1; 2016.11.2; +1 more |
| CVE-2024-38824 | 7.5 | Jun 13 | Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory Affected: 3006.0 before 3006.12; 3007.0 before 3007.4 |
| CVE-2021-21996 | 7.5 | Sep 8 | An issue was discovered in SaltStack Salt before 3003.3 Affected: before 3000.3 |
| CVE-2017-14696 | 7.5 | Oct 24 | SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request Affected: through 2016.3.7; 2016.11; 2016.11.0; 2016.11.1; 2016.11.1; 2016.11.1; +9 more |
| CVE-2015-4017 | 7.5 | Aug 25 | Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules Affected: 2014.7.5 |
| CVE-2020-35662 | 7.4 | Feb 27 | In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated Affected: before 2015.8.10; 2015.8.11 before 2015.8.13; 2016.3.0 before 2016.3.4; 2016.3.5 before 2016.3.6; 2016.3.7 before 2016.3.8; 2016.3.9 before 2016.11.3; +9 more |
Showing 17