CVE-2013-4439

2022-10-0316:14:58

CWE-264

[email protected]

web.nvd.nist.gov

cve-2013-4439

salt

saltstack

remote authentication

impersonation

4.9 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

6.2 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

53.7%

JSON

Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key.

Affected configurations

NVD

Node

saltstacksaltMatch0.15.0

saltstacksaltMatch0.15.1

saltstacksaltMatch0.16.0

saltstacksaltMatch0.16.2

saltstacksaltMatch0.16.3

saltstacksaltMatch0.16.4

saltstacksaltMatch0.17.0

CPENameOperatorVersion
saltstack:saltsaltstack salteq0.15.0
saltstack:saltsaltstack salteq0.15.1
saltstack:saltsaltstack salteq0.16.0
saltstack:saltsaltstack salteq0.16.2
saltstack:saltsaltstack salteq0.16.3
saltstack:saltsaltstack salteq0.16.4
saltstack:saltsaltstack salteq0.17.0

CPE	Name	Operator	Version
saltstack:salt	saltstack salt	eq	0.15.0
saltstack:salt	saltstack salt	eq	0.15.1
saltstack:salt	saltstack salt	eq	0.16.0
saltstack:salt	saltstack salt	eq	0.16.2
saltstack:salt	saltstack salt	eq	0.16.3
saltstack:salt	saltstack salt	eq	0.16.4
saltstack:salt	saltstack salt	eq	0.17.0