VulnerabilityModified
CVE-2018-15751
SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).
CRITICAL 9.8EPSS 5.24%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 5.24% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- saltstack/salt
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html
- https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.htmlRelease Notes, Vendor Advisory
- https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.htmlRelease Notes, Vendor Advisory
- https://groups.google.com/d/msg/salt-users/L9xqcJ0UXxs/qgDj42obBQAJRelease Notes, Third Party Advisory
- https://groups.google.com/d/msg/salt-users/dimVF7rpphY/jn3Xv3MbBQAJRelease Notes, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/07/msg00024.html
- https://usn.ubuntu.com/4459-1/
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html
- https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.htmlRelease Notes, Vendor Advisory
- https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.htmlRelease Notes, Vendor Advisory
- https://groups.google.com/d/msg/salt-users/L9xqcJ0UXxs/qgDj42obBQAJRelease Notes, Third Party Advisory
- https://groups.google.com/d/msg/salt-users/dimVF7rpphY/jn3Xv3MbBQAJRelease Notes, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/07/msg00024.html
- https://usn.ubuntu.com/4459-1/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.