An issue was discovered in SaltStack Salt through 3002.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• debian debian linux10.0
• debian debian linux9.0
• fedoraproject fedora31
• opensuse leap15.1
• saltstack saltbefore 2015.8.10
• saltstack salt2016.3.7 and later · before 2016.3.8
• saltstack salt2016.11.0 and later · before 2016.11.3
• saltstack salt2016.11.4 and later · before 2016.11.6
• saltstack salt2016.11.7 and later · before 2016.11.10
• saltstack salt2017.5.0 and later · before 2017.7.4
• saltstack salt2017.7.5 and later · before 2017.7.8
• saltstack salt2018.2.0 and later · before 2018.3.5
• saltstack salt2019.2.0 and later · before 2019.2.5
• saltstack salt3000.0 and later · before 3000.3
• saltstack salt2015.8.11 and later · before 2015.8.13
• saltstack salt2016.3.5 and later · before 2016.3.6
• saltstack salt2016.3.0 and later · before 2016.3.4
• saltstack salt3001
• saltstack salt3002

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2020-11651An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.KEV
  98Now
• CVE-2020-11652An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.KEV
  82Now
• CVE-2021-25282An issue was discovered in through SaltStack Salt before 3002.5.
  64This week
• CVE-2021-3197An issue was discovered in SaltStack Salt before 3002.5.
  61This week
• CVE-2021-25281An issue was discovered in through SaltStack Salt before 3002.5.
  61This week
• CVE-2020-25592In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens.
  56Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.