CVE-2021-25315

🗓️ 03 Mar 2021 09:55:16Reported by suseType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 169 Views

Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions

Reporter	Title	Published	Views	Family All 60
Circl	CVE-2021-25315	3 Mar 202112:45	–	circl
CNNVD	SUSE Linux Enterprise Server 授权问题漏洞	3 Mar 202100:00	–	cnnvd
Cvelist	CVE-2021-25315 salt-api unauthenticated remote code execution	3 Mar 202109:55	–	cvelist
Debian CVE	CVE-2021-25315	3 Mar 202109:55	–	debiancve
EUVD	EUVD-2022-4798	3 Oct 202520:07	–	euvd
Github Security Blog	Saltstack Salt Unauthenticated Arbitrary Code Execution	24 May 202217:43	–	github
NVD	CVE-2021-25315	3 Mar 202110:15	–	nvd
Tenable Nessus	openSUSE 15 Security Update : salt (openSUSE-SU-2021:2106-1)	16 Jul 202100:00	–	nessus
Tenable Nessus	openSUSE 15 Security Update : salt (openSUSE-SU-2021:0899-1)	28 Jun 202100:00	–	nessus
Tenable Nessus	Photon OS 4.0: Salt3 PHSA-2021-4.0-0047	21 Jun 202100:00	–	nessus

NVD

Node

saltstack saltRange<3002.2

AND

opensuse tumbleweedMatch-

suse suse_linux_enterprise_serverMatch15sp3

[
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Server 15 SP 3",
    "versions": [
      {
        "version": "salt",
        "status": "affected",
        "lessThan": "3002.2-3",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "openSUSE",
    "product": "Tumbleweed",
    "versions": [
      {
        "version": "salt",
        "status": "affected",
        "lessThanOrEqual": "3002.2-2.1",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
bugzilla	www.bugzilla.suse.com/show_bug.cgi

21 Nov 2024 05:54Current

8.7High risk

Vulners AI Score8.7

CVSS 24.6

CVSS 3.17.8 - 9.8

EPSS0.00153

CWE-287