CVE-2017-5192

Опубликовано: 26 сент. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

Ссылки

https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия до 2015.8.12 (включая)

cpe:2.3:a:saltstack:salt:2016.3.0:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.3.1:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.3.2:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.3.3:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.3.4:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.0:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.1:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.2:*:*:*:*:*:*:*

EPSS

Процентиль: 36%

0.00149

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-287

Связанные уязвимости

CVE-2017-5192

CVSS3: 8.8

ubuntu

больше 8 лет назад

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed. The LocalClient.cmd_batch() method client does not accept external_auth credentials and so access to it from salt-api has been removed for now. This vulnerability allows code execution for already-authenticated users and is only in effect when running salt-api as the root user.

CVE-2017-5192

CVSS3: 7.5

redhat

около 9 лет назад

CVE-2017-5192

CVSS3: 8.8

debian

больше 8 лет назад

When using the local_batch client from salt-api in SaltStack Salt befo ...

GHSA-f2h7-4f84-8qrm

CVSS3: 8.8

github

больше 3 лет назад

SaltStack Salt Authentication Bypass when using the local_batch client from salt-api

EPSS

Процентиль: 36%

0.00149

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-287