CVSS: 7.2EPSS: 0%CPEs: 17EXPL: 0CVE-2023-34049 – Salt security advisory release - 2023-OCT-27
https://notcve.org/view.php?id=CVE-2023-34049
14 Nov 2024 — The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails. The Salt-SSH pre-flight option copies the sc... • https://saltproject.io/security-announcements/2023-10-27-advisory •
CVSS: 7.7EPSS: 0%CPEs: 16EXPL: 0CVE-2024-22232 – Specially crafted url can be created which leads to a directory traversal in the salt file server
https://notcve.org/view.php?id=CVE-2024-22232
27 Jun 2024 — A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem. Se puede crear una URL especialmente manipulada que conduzca a directory traversal en el servidor de archivos salt. Un usuario malintencionado puede leer un archivo arbitrario del sistema de archivos de un maestro Salt. A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious u... • https://saltproject.io/security-announcements/2024-01-31-advisory • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 0%CPEs: 16EXPL: 0CVE-2024-22231 – Syndic cache directory creation is vulnerable to a directory traversal attack
https://notcve.org/view.php?id=CVE-2024-22231
27 Jun 2024 — Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master. La creación de un directorio de caché síndico es vulnerable a un ataque de directory transversal en un proyecto Salt que puede llevar a un atacante malintencionado a crear un directorio arbitrario en un maestro Salt. Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a mal... • https://saltproject.io/security-announcements/2024-01-31-advisory • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •