Lucene search

CVE-2020-28243

🗓️ 27 Feb 2021 05:13:15Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 19 Media mentions👁 245 Views🌐 WEB

An issue in SaltStack Salt before 3002.5 allows local privilege escalation via crafted process name

5 of 5AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 79
CNVD	SaltStack Salt Command Injection Vulnerability (CNVD-2021-15056)	1 Mar 202100:00	–	cnvd
Veracode	OS Command Injection	1 Mar 202106:07	–	veracode
Prion	Command injection	27 Feb 202105:15	–	prion
Github Security Blog	SaltStack Salt command injection via a crafted process name	24 May 202217:43	–	github
Debian CVE	CVE-2020-28243	27 Feb 202105:15	–	debiancve
OSV	GHSA-PHHW-3WC9-8Q75 SaltStack Salt command injection via a crafted process name	24 May 202217:43	–	osv
OSV	CVE-2020-28243	27 Feb 202105:15	–	osv
OSV	UBUNTU-CVE-2020-28243	27 Feb 202105:15	–	osv
OSV	PYSEC-2021-73	27 Feb 202105:15	–	osv
OSV	SUSE-SU-2021:0626-1 Security update for py26-compat-salt	26 Feb 202110:11	–	osv

Nvd

Node

saltstack saltRange<2015.8.10

saltstack saltRange2015.8.11–2015.8.13

saltstack saltRange2016.3.0–2016.3.4

saltstack saltRange2016.3.5–2016.3.6

saltstack saltRange2016.3.7–2016.3.8

saltstack saltRange2016.3.9–2016.11.3

saltstack saltRange2016.11.4–2016.11.5

saltstack saltRange2016.11.7–2016.11.10

saltstack saltRange2017.5.0–2017.7.8

saltstack saltRange2018.2.0–2018.3.5

saltstack saltRange2019.2.0–2019.2.5

saltstack saltRange2019.2.6–2019.2.8

saltstack saltRange3000–3000.6

saltstack saltRange3001–3001.4

saltstack saltRange3002–3002.5

Node

fedoraproject fedoraMatch32

fedoraproject fedoraMatch33

fedoraproject fedoraMatch34

Node

debian debian_linuxMatch9.0

debian debian_linuxMatch10.0

debian debian_linuxMatch11.0

Source	Link
lists	www.lists.debian.org/debian-lts-announce/2021/11/msg00009.html
security	www.security.gentoo.org/glsa/202103-01
security	www.security.gentoo.org/glsa/202310-22
sec	www.sec.stealthcopter.com/cve-2020-28243/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/
github	www.github.com/stealthcopter/CVE-2020-28243
debian	www.debian.org/security/2021/dsa-5011
saltproject	www.saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/

Parameter	Position	Path	Description	CWE
process name	path	restartcheck.restartcheck	Command injection vulnerability allowing privilege escalation via crafted process names.	CWE-77

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

27 Feb 2021 05:15Current

8.5High risk

Vulners AI Score8.5

CVSS24.4

CVSS37.8

EPSS0.0188

CWE-77