PT-2020-3606 · Saltstack +3 · Saltstack Salt +3

🗓️ 29 Jul 2019 00:00:00Reported by Positive TechnologiesType

SaltMaster ClearFuncs allows unauthenticated method access, risking token exposure and remote commands.

Reporter	Title	Published	Views	Family All 806
zdt	Saltstack 3000.1 - Remote Code Execution Exploit	4 May 202000:00	–	zdt
zdt	Saltstack 3000.1 Remote Code Execution Exploit	7 May 202000:00	–	zdt
zdt	SaltStack Salt Master/Minion Unauthenticated Remote Code Execution Exploit	12 May 202000:00	–	zdt
zdt	SaltStack Salt REST API Arbitrary Command Execution Exploit	12 Nov 202000:00	–	zdt
zdt	SaltStack Salt API Unauthenticated Remote Command Execution Exploit	2 Apr 202100:00	–	zdt
GithubExploit	Exploit for CVE-2020-11651	4 May 202011:52	–	githubexploit
GithubExploit	Exploit for CVE-2020-11651	7 May 202009:17	–	githubexploit
GithubExploit	Exploit for CVE-2020-11651	4 May 202011:47	–	githubexploit
GithubExploit	Exploit for CVE-2020-11651	4 May 202020:34	–	githubexploit
GithubExploit	Exploit for CVE-2020-11651	7 May 202009:17	–	githubexploit

Source	Link
github	www.github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/saltstack_salt_wheel_async_rce.rb
github	www.github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/saltstack_salt_api_cmd_exec.rb
github	www.github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/saltstack_salt_root_key.rb
github	www.github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/saltstack_salt_unauth_rce.rb
github	www.github.com/jasperla/CVE-2020-11651-poc
github	www.github.com/dozernz/cve-2020-11651
github	www.github.com/rossengeorgiev/salt-security-backports
github	www.github.com/0xc0d/CVE-2020-11651
github	www.github.com/heikanet/CVE-2020-11651-CVE-2020-11652-EXP
github	www.github.com/ssrsec/CVE-2020-11651-CVE-2020-11652-EXP

03 Apr 2025 00:00Current

7.8High risk

Vulners AI Score7.8

CVSS 3.19.8

CVSS 27.5

CVSS 39.8

EPSS0.99585

SSVC