CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
SaltStack Salt-Master ClearFuncs Directory Traversal Vulnerability (CVE-2020-11652) Analysis and Mitigation Guide
[Affected Scope] SaltStack Salt versions before 2019.2.4 and 3000 before 3000.2
[Impact] Authenticated users can access arbitrary directories and retrieve sensitive files via improperly sanitized paths in the ClearFuncs class of the salt-master process
[Mitigation] Immediately upgrade SaltStack to the latest stable versions (2019.2.4, 3000.2 or higher) and restrict access to master ports (4505, 4506)
SaltStack Salt Unauthenticated Remote Code Execution (RCE) Vulnerability Analysis (CVE-2020-11651)
[Affected Scope] SaltStack Salt versions before 2019.2.4 and 3000 before 3000.2
[Impact] Unauthenticated remote attackers can bypass authentication via the ClearFuncs class to retrieve master tokens or execute arbitrary commands on connected salt minions
[Mitigation] Immediately upgrade SaltStack to patched versions (2019.2.4, 3000.2, or higher) and restrict access to salt-master ports (4505, 4506)