Improper Authorization

Salt is vulnerable to Improper Authorization. The vulnerability is due to improper authorization due to the master's minionevent method allowing authorized minions to inject arbitrary events into the master's event bus...

Directory Traversal

Salt is vulnerable to a Directory traversal. The vulnerability is due to improper validation of file paths during cache creation, allowing attackers to write or overwrite files outside the intended cache directory...

Remote Code Execution (RCE)

Salt is vulnerable to Remote command execution. The vulnerability is due to improper input validation in the 'on demand' pillar functionality, allowing a specially crafted git URL to trigger arbitrary command execution on the master with elevated privileges...

File Overwrite

Salt is vulnerable to File overwrite. The vulnerability is due to unvalidated input used to construct paths in the VirtKey class when handling “on-demand pillar” data, allowing unauthorized file overwrites in the default configuration...

Improper Authentication

salt is vulnerable to Improper Authentication. The vulnerability is due to improper validation logic in the salt.auth.pki module, which treats the presence of a valid public certificate as sufficient for authentication without requiring the corresponding private key, allows an attacker to bypass...

Authorization Bypass

Salt is vulnerable to an Authorization Bypass. The vulnerability is due to improper validation of minion messages, allowing an attacker with access to a minion key to execute jobs on other minions...

GHSA-FCR4-H6C4-RVVP Salt's on demand pillar functionality vulnerable to arbitrary command injections

An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process...

Directory Traversal

Overview salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable t...

Improper Validation of Specified Type of Input

Overview salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable t...

Replay Attack

Overview salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable t...

Improper Certificate Validation

Overview salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable t...

CVE-2024-38823 CVE-2024-38823 Salt Advisory

Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration and remote execution application from the Salt project. A security vulnerability exists in Salt that stems from the use of unvalidated input to create paths in the findfile method of the GitFS class, which could lead to...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration, and remote execution application from the Salt project. A security vulnerability exists in Salt that stems from multiple methods of skipping minion token validation, which could lead to a malicious minion impersonating...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration, and remote execution application from the Salt project. A security vulnerability exists in Salt that stems from the VirtKey class creating paths using unvalidated input, which could lead to file content overwriting...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration and remote execution application from the Salt project. Salt has a security vulnerability that stems from vulnerability to replay attacks when TLS encrypted transmissions are not used...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration, and remote execution application from the Salt project. A security vulnerability exists in Salt that stems from an event bus authorization bypass that could lead an attacker to execute jobs on other minions...

PT-2025-25387 · Salt +1 · Salt +1

Name of the Vulnerable Software and Affected Versions: Salt affected versions not specified Description: The issue concerns Salt's request server being vulnerable to replay attacks when not using a TLS encrypted transport. Recommendations: At the moment, there is no information about a newer...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration, and remote execution application from the Salt project. A security vulnerability exists in Salt that stems from an authorized minion that can inject arbitrary events into the main event bus...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration, and remote execution application from the Salt project. A security vulnerability exists in Salt that stems from a directory traversal attack in minion file cache creation, which could result in writing or overwriting fil...