Linux Distros Unpatched Vulnerability : CVE-2021-3144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. They might be used to run command against the salt master or minions...

Linux Distros Unpatched Vulnerability : CVE-2017-7893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master. CVE-2017-7893 Note that Nessus relies on the presence of the packag...

Linux Distros Unpatched Vulnerability : CVE-2020-25592

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH...

Linux Distros Unpatched Vulnerability : CVE-2022-22934

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion's public key, which ca...

Linux Distros Unpatched Vulnerability : CVE-2022-22941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisheracl, if a user...

Linux Distros Unpatched Vulnerability : CVE-2021-3197

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, ...

SaltStack 3000 < 3006.12 / 3007 < 3007.4 Multiple Vulnerabilities

According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by multiple vulnerabilities, including the following: - Directory traversal vulnerability in recvfile method allows arbitrary files to be written to the master cache directory...

CVE-2018-1999027

An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins...

CVE-2013-2228

SaltStack RSA Key Generation allows remote users to decrypt communications...

CVE-2019-1010259

SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.userchpass function from the MySQL module for Salt. The attack vector is: specially crafted...

PT-2025-25392

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url, which could cause an arbitrary command to be run on the master with t...

PT-2025-25391

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions 3007.0 and later Description The issue concerns an authorization bypass in the Minion event bus. An attacker with access to a minion key can craft a message to potentially execute a job on other minions. Recommendations...

PT-2025-25393

Name of the Vulnerable Software and Affected Versions SaltStack Salt affected versions not specified Description The issue concerns a directory traversal attack in minion file cache creation. The master's default cache is vulnerable to this attack, which could be leveraged to write or overwrite...

SaltStack Salt Master Server Root Key Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SaltStack Salt Master Server Root Key Disclosure', 'Description' = %q This module exploits unauthenticated access to the prepauthinfo method in t...

Path traversal in saltstack

A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem...

Directory creation by malicious user in saltstack

Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master...

GHSA-2QW3-2WV6-P64X Path traversal in saltstack

A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem...

GHSA-Q27C-J6J9-53W3 Directory creation by malicious user in saltstack

Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master...

Kinsing Hacker Group Exploits More Flaws to Expand Botnet for Cryptojacking

The cryptojacking group known as Kinsing has demonstrated an ability to continuously evolve and adapt, proving to be a persistent threat by swiftly integrating newly disclosed vulnerabilities to the exploit arsenal and expand its botnet. The findings come from cloud security firm Aqua, which...

Improper Authentication

Salt aka SaltStack is vulnerable to Improper Authentication. The vulnerability is due to a lack of authentication during routine execution, allowing authenticated users with certain privileges to bypass restrictions by nesting restricted routines within other routines...