CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
SaltStack Salt API SSH Client Shell Injection Remote Code Execution Vulnerability (CVE-2020-16846)
[Affected Scope] SaltStack Salt versions up to and including 3002 with Salt API and SSH client enabled
[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the target server by sending crafted HTTP requests
[Mitigation] Apply the official SaltStack security patches immediately, or disable the SSH client integration in the Salt API configuration
SaltStack Salt Unauthenticated Remote Code Execution (RCE) Vulnerability Analysis (CVE-2020-11651)
[Affected Scope] SaltStack Salt versions before 2019.2.4 and 3000 before 3000.2
[Impact] Unauthenticated remote attackers can bypass authentication via the ClearFuncs class to retrieve master tokens or execute arbitrary commands on connected salt minions
[Mitigation] Immediately upgrade SaltStack to patched versions (2019.2.4, 3000.2, or higher) and restrict access to salt-master ports (4505, 4506)