Lucene search

[email protected]CVE-2021-25315

HistoryMar 03, 2021 - 10:15 a.m.

CVE-2021-25315

2021-03-0310:15:13

CWE-287

[email protected]

web.nvd.nist.gov

141

cve-2021-25315

cwe-287

improper authentication

suse linux enterprise server

opensuse tumbleweed

arbitrary code execution

vulnerability

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.3%

JSON

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.

Affected configurations

NVD

Node

opensusetumbleweedMatch-

susesuse_linux_enterprise_serverMatch15sp3

AND

saltstacksaltRange<3002.2

CPENameOperatorVersion
saltstack:saltsaltstack saltlt3002.2

CPE	Name	Operator	Version
saltstack:salt	saltstack salt	lt	3002.2

CNA Affected

[
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Server 15 SP 3",
    "versions": [
      {
        "version": "salt",
        "status": "affected",
        "lessThan": "3002.2-3",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "openSUSE",
    "product": "Tumbleweed",
    "versions": [
      {
        "version": "salt",
        "status": "affected",
        "lessThanOrEqual": "3002.2-2.1",
        "versionType": "custom"
      }
    ]
  }
]