CVE-2024-22232

2024-06-2700:00:00

ubuntu.com

crafted url

directory traversal

salt file server

arbitrary file access

unix

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.2%

JSON

A specially crafted url can be created which leads to a directory traversal
in the salt file server.
A malicious user can read an arbitrary file from a Salt master’s
filesystem.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchsalt< anyUNKNOWN
ubuntu22.04noarchsalt< anyUNKNOWN
ubuntu14.04noarchsalt< anyUNKNOWN
ubuntu16.04noarchsalt< anyUNKNOWN