CVE-2020-16846

🗓️ 06 Nov 2020 07:27:24Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 1198 Views🌐 WEB

CVE-2020-16846: SaltStack Salt through 3002. Shell injection via crafted web requests

Reporter	Title	Published	Views	Family All 118
0day.today	SaltStack Salt REST API Arbitrary Command Execution Exploit	12 Nov 202000:00	–	zdt
FreeBSD	salt -- multiple vulnerabilities	6 Nov 202000:00	–	freebsd
GithubExploit	Exploit for OS Command Injection in Saltstack Salt	14 Oct 202110:09	–	githubexploit
ATTACKERKB	CVE-2020-16846 — SaltStack Unauthenticated Shell Injection	6 Nov 202000:00	–	attackerkb
ATTACKERKB	CVE-2020-25592 — SaltStack Authentication Bypass and Salt SSH Command Execution	6 Nov 202000:00	–	attackerkb
AlpineLinux	CVE-2020-16846	6 Nov 202007:27	–	alpinelinux
ArchLinux	[ASA-202011-7] salt: multiple issues	10 Nov 202000:00	–	archlinux
BDU FSTEC	The vulnerability of the configuration management system and remote execution of operations, related to the lack of measures to neutralize special elements, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.	6 Apr 202100:00	–	bdu_fstec
Circl	CVE-2020-16846	11 Nov 202019:52	–	circl
CISA KEV Catalog	SaltStack Salt Shell Injection Vulnerability	3 Nov 202100:00	–	cisa_kev

NVD

Node

saltstack saltRange<2015.8.10

saltstack saltRange2015.8.11–2015.8.13

saltstack saltRange2016.3.0–2016.3.4

saltstack saltRange2016.3.5–2016.3.6

saltstack saltRange2016.3.7–2016.3.8

saltstack saltRange2016.11.0–2016.11.3

saltstack saltRange2016.11.4–2016.11.6

saltstack saltRange2016.11.7–2016.11.10

saltstack saltRange2017.5.0–2017.7.4

saltstack saltRange2017.7.5–2017.7.8

saltstack saltRange2018.2.0–2018.3.5

saltstack saltRange2019.2.0–2019.2.5

saltstack saltRange3000.0–3000.3

Node

Node

Node

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-20-1379/
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-20-1383/
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-20-1382/
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-20-1380/
packetstormsecurity	www.packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/
security	www.security.gentoo.org/glsa/202011-13
lists	www.lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html
lists	www.lists.debian.org/debian-lts-announce/2020/12/msg00007.html
debian	www.debian.org/security/2021/dsa-4837

Parameter	Position	Path	Description	CWE
client	request body	salt_ip_addr:8000/run	Shell injection via Salt-API run endpoint when using SSH client with crafted payload (CVE-2020-16846).	CWE-78
tgt	request body	salt_ip_addr:8000/run	Shell injection via Salt-API run endpoint when using SSH client with crafted payload (CVE-2020-16846).	CWE-78
fun	request body	salt_ip_addr:8000/run	Shell injection via Salt-API run endpoint when using SSH client with crafted payload (CVE-2020-16846).	CWE-78
eauth	request body	salt_ip_addr:8000/run	Shell injection via Salt-API run endpoint when using SSH client with crafted payload (CVE-2020-16846).	CWE-78
ssh_priv	request body	salt_ip_addr:8000/run	Shell injection via Salt-API run endpoint when using SSH client with crafted payload (CVE-2020-16846).	CWE-78

17 Jun 2026 02:58Current

9.3High risk

Vulners AI Score9.3

CVSS 27.5

CVSS 3.19.8

EPSS0.99585

SSVC