Homepage
About Snyk

Arbitrary Code Execution Affecting salt package, versions [,2015.8.12) [2016.3, 2016.3.5) [2016.11, 2016.11.2)

Severity

 Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    EPSS
    0.21% (59th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-SALT-40452
  • published 7 Nov 2017
  • disclosed 20 Mar 2017
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 20 Mar 2017

CVE-2017-5192 Open this link in a new tab
CWE-94 Open this link in a new tab

Overview

salt is a Portable, distributed, remote execution and configuration management system.

Affected versions of this package are vulnerable to Arbitrary Code Execution. When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

References

CVSS Scores

version 3.1
Expand this section

Snyk

8.8 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    High