CVE-2017-5200

Опубликовано: 26 сент. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 9

EPSS Низкий

Описание

Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client.

Ссылки

https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html
Release Notes
Vendor Advisory
https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*

Версия до 2015.8.12 (включая)

cpe:2.3:a:saltstack:salt:2016.3.0:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.3.1:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.3.2:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.3.3:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.3.4:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.0:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.1:*:*:*:*:*:*:*

cpe:2.3:a:saltstack:salt:2016.11.2:*:*:*:*:*:*:*

EPSS

Процентиль: 79%

0.01262

Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2017-5200

CVSS3: 8.8

ubuntu

больше 8 лет назад

Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client. Users of Salt-API and salt-ssh could execute a command on the salt master via a hole when both systems were enabled.

CVE-2017-5200

CVSS3: 7.5

redhat

около 9 лет назад

Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client.

CVE-2017-5200

CVSS3: 8.8

debian

больше 8 лет назад

Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, ...

GHSA-8r7r-x48r-pf8f

CVSS3: 8.8

github

больше 3 лет назад

SaltStack Salt arbitrary command execution in Salt-api via ssh_client

SUSE-SU-2017:1582-1

suse-cvrf

больше 8 лет назад

Security update for Salt

EPSS

Процентиль: 79%

0.01262

Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

NVD-CWE-noinfo