The vulnerability of the configuration management system and the remote execution feature of SaltStack Salt allow a perpetrator to temporarily increase their privileges locally.

SaltStack configuration management and remote execution flaw enables local privilege escalation via file creation tied to minion reboot checks.

Reporter	Title	Published	Views	Family All 111
GithubExploit	Exploit for Command Injection in Saltstack Salt	22 Dec 202019:35	–	githubexploit
FreeBSD	salt -- multiple vulnerabilities	25 Feb 202100:00	–	freebsd
ArchLinux	[ASA-202102-33] salt: multiple issues	27 Feb 202100:00	–	archlinux
Circl	CVE-2020-28243	27 Feb 202107:39	–	circl
CNNVD	Saltstack SaltStack Salt 命令注入漏洞	26 Feb 202100:00	–	cnnvd
CNVD	SaltStack Salt Command Injection Vulnerability (CNVD-2021-15056)	1 Mar 202100:00	–	cnvd
CVE	CVE-2020-28243	27 Feb 202100:00	–	cve
Cvelist	CVE-2020-28243	27 Feb 202100:00	–	cvelist
Debian	[SECURITY] [DLA 2480-2] salt regression update	3 Jan 202220:17	–	debian
Debian	[SECURITY] [DLA 2815-1] salt security update	10 Nov 202118:08	–	debian

Vulners

Node

saltstack,saltRange<2015.8.10

saltstack,saltRange2015.8.11–2015.8.13

saltstack,saltRange2016.3.0–2015.3.4

saltstack,saltRange2016.3.5–2016.3.6

saltstack,saltRange2016.3.7–2016.3.8

saltstack,saltRange2016.3.9–2016.11.3

saltstack,saltRange2016.11.4–2016.11.5

saltstack,saltRange2016.11.7–2016.11.10

saltstack,saltRange2017.5.0–2017.7.8

saltstack,saltRange2018.2.0–2018.3.5

saltstack,saltRange2019.2.0–2019.2.5

saltstack,saltRange2019.2.6–2019.2.8

saltstack,saltRange3000–3000.6

saltstack,saltRange3001–3001.4

saltstack,saltRange3002–3002.5

Source	Link
saltproject	www.saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
lists	www.lists.debian.org/debian-lts-announce/2021/11/msg00009.html
debian	www.debian.org/security/2021/dsa-5011
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.5/
altsp	www.altsp.su/obnovleniya-bezopasnosti/
web	www.web.nvd.nist.gov/view/vuln/detail

16 Sep 2024 00:00Current

7.7High risk

Vulners AI Score7.7

CVSS 24.6

CVSS 37.8

EPSS0.04302