VulnerabilityModified
CVE-2016-3176
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
MEDIUM 5.6EPSS 0.87%
Does this matter?
Lower severity and a low EPSS score (0.87%). Track it; it rarely justifies an emergency change on its own.
Description
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
- CVSS 3.0
- 5.6 MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
- EPSS
- 0.87% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- saltstack/salt
- Source
- cve@mitre.org
References
- https://docs.saltstack.com/en/latest/topics/releases/2015.5.10.htmlRelease Notes, Vendor Advisory
- https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.htmlRelease Notes, Vendor Advisory
- https://docs.saltstack.com/en/latest/topics/releases/2015.5.10.htmlRelease Notes, Vendor Advisory
- https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.htmlRelease Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.