2422 matches found
Remote Code Execution (RCE)
Salt is vulnerable to remote code execution RCE. The localbatch client external authentication does not accept externalauth credentials. This allows code execution for already-authenticated users and is only in effect when running salt-api as the root user...
Unauthorised File Editing Or Replacement
salt has a flaw that can lead to unauthorized file editing or replacement. This is possible because it does not validate the file path input to the sed method. Therefore, it does not properly search and replace on given filename , leading to unintended unauthorized file editing or replacement...
Insecure Redirection
salt is vulnerable to insecure redirection. Due to a flaw, it performs redirections and thus bypasses security checks...
Information Disclosure
salt is vulnerable to information disclosure. The system allows a minion to access any file in the master system, meaning a malicious user can manipulate a minion to access sensitive data...
Information Disclosure
salt is vulnerable to information disclosure. The library displays the password of a newly created user in plaintext to the user that just created a new user account...
Remote Code Execution (RCE)
salt is vulnerable to remote code execution RCE. The library does not clear messages on the minion, meaning a malicious user can conduct a Man-in-the-Middle MitM attack to execute arbitrary code by inserting packets into the datastream...
Information Disclosure
salt is vulnerable to information disclosures. The library stores it secrets in a file called highstate.cache.p that is world readable, allowing a malicious user to access sensitive information...
SaltStack Salt Information Disclosure Vulnerability (CNVD-2017-01659)
Salt a.k.a. SaltStack is an open source set of tools for managing infrastructure from SaltStack, Inc. in the United States. A security vulnerability exists in versions of Salt prior to 2015.8.3 that stems from the program assigning weak permissions to cached data. A local attacker could exploit t...
CVE-2017-5192
When using the localbatch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed. Mitigation Disable salt-api for mitigation...
Directory Traversal
salt is vulnerable to directory traversal. It uses os.stat that follows symbolic links to get targets, allowing an attacker to access other directories beyond the specified directory and change the ownership...
Command Injection
Salt is vulnerable to command injection. It does not properly sanitize the input arguments from the disk usage command, leading to a command injection vulnerability...
Man In The Middle (MitM)
Salt is vulnerable to man in the middle MitM attack in minion authentication. It does not check the integrity of the message sent back by the master. It is possible to intercept the communication between the minion and master and alter certain information...
Path Injection Via Minion Ids
Salt is vulnerable to path injection attacks via minion ids. Salt masters do not properly validate the id of a connecting minion. This can lead to an attacker uploading files to the master in arbitrary locations. In particular, this can be used to bypass the manual validation of new unknown...
Timing Attack
salt is vulnerable to timing attacks. This vulnerability is due to the use of a regular string comparison function to verify an HMAC-SHA256 signature...
PYSEC-2017-34
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching...
Design/Logic Flaw
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching...
PYSEC-2017-34
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching...
CVE-2016-9639
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching...
