CVSS: 6.5EPSS: 97%CPEs: 13EXPL: 7CVE-2020-11652 – SaltStack Salt Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2020-11652
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users. Se descubrió un problema en SaltStack Salt versiones anteriores a la versión 2019.2.4 y versiones 3000 anteriores a 3000.2. La clase ClearFuncs del proceso Salt-master permite acceder a algunos métodos que sanean inapropiadamente las rutas. • https://www.exploit-db.com/exploits/48421 https://github.com/ssrsec/CVE-2020-11651-CVE-2020-11652-EXP https://github.com/Al1ex/CVE-2020-11652 https://github.com/limon768/CVE-2020-11652-POC https://github.com/fanjq99/CVE-2020-11652 https://github.com/appcheck-ng/salt-rce-scanner-CVE-2020-11651-CVE-2020-11652 http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00047.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html http://packetstormsecurit • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 97%CPEs: 10EXPL: 10CVE-2020-11651 – SaltStack Salt Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-11651
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions. Se ha descubierto un fallo de salto de archivo en todas las versiones de ansible-engine 2.9.x anteriores a la versión 2.9.7, cuando se ejecuta una instalación de una colección ansible-galaxy. • https://www.exploit-db.com/exploits/48421 https://github.com/jasperla/CVE-2020-11651-poc https://github.com/ssrsec/CVE-2020-11651-CVE-2020-11652-EXP https://github.com/0xc0d/CVE-2020-11651 https://github.com/kevthehermit/CVE-2020-11651 https://github.com/RakhithJK/CVE-2020-11651 https://github.com/appcheck-ng/salt-rce-scanner-CVE-2020-11651-CVE-2020-11652 https://github.com/hardsoftsecurity/CVE-2020-11651-PoC http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00 •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-17361
https://notcve.org/view.php?id=CVE-2019-17361
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host. En SaltStack Salt hasta 2019.2.0, la API NET de salt-api con el cliente ssh habilitado es vulnerable a la inyección de comandos. Esto permite que un atacante no autenticado con acceso de red al punto final de la API ejecute código arbitrario en el host salt-api. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html#security-fix https://github.com/saltstack/salt/commits/master https://usn.ubuntu.com/4459-1 https://www.debian.org/security/2020/dsa-4676 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2019-1010259
https://notcve.org/view.php?id=CVE-2019-1010259
SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. • https://github.com/ShantonRU/salt/commit/a46c86a987c78e74e87969d8d3b27094e6544b7a https://github.com/saltstack/salt/blob/f22de0887cd7167887f113bf394244b74fb36b6b/salt/modules/mysql.py#L1534 https://github.com/saltstack/salt/pull/51462 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 2%CPEs: 2EXPL: 0CVE-2018-15751
https://notcve.org/view.php?id=CVE-2018-15751
SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi). SaltStack Salt en versiones anteriores a la 2017.7.8 y 2018.3.x en versiones anteriores a la 2018.3.3 permite que los atacantes remotos omitan la autenticación y ejecuten comandos arbitrarios mediante salt-api(netapi). • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html https://groups.google.com/d/msg/salt-users/L9xqcJ0UXxs/qgDj42obBQAJ https://groups.google.com/d/msg/salt-users/dimVF7rpphY/jn3Xv3MbBQAJ https://lists.debian.org/debian-lts-announce/2020/07/msg00024.html https://usn.ubuntu.com/4459-1 • CWE-287: Improper Authentication •