Описание
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | released | 2017.7.4+dfsg1-1ubuntu18.04.2 |
| devel | DNE | |
| disco | ignored | end of life |
| eoan | ignored | end of life |
| esm-apps-legacy/xenial | released | 2015.8.8+ds-1ubuntu0.1 |
| esm-apps/bionic | released | 2017.7.4+dfsg1-1ubuntu18.04.2 |
| esm-apps/jammy | not-affected | 3000+dfsg1-1 |
| esm-apps/xenial | released | 2015.8.8+ds-1ubuntu0.1 |
| esm-infra-legacy/trusty | needed | |
| esm-infra/focal | DNE |
Показывать по
EPSS
6.8 Medium
CVSS2
9.8 Critical
CVSS3
Связанные уязвимости
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh ...
SaltStack Salt is vulnerable to command injection
Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, существующая из-за непринятия мер по нейтрализации специальных элементов, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
EPSS
6.8 Medium
CVSS2
9.8 Critical
CVSS3