| CVE-2021-25284 |
Medium |
No |
Information disclosure |
An issue was discovered in SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level. |
| CVE-2021-25283 |
High |
Yes |
Cross-site scripting |
An issue was discovered in SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks. |
| CVE-2021-25282 |
Medium |
Yes |
Directory traversal |
An issue was discovered in SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. |
| CVE-2021-25281 |
High |
Yes |
Access restriction bypass |
An issue was discovered in SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can... |
| CVE-2021-3197 |
High |
Yes |
Arbitrary command execution |
An issue was discovered in SaltStack Salt before 3002.5. The salt- api's ssh client is vulnerable to a shell injection by including ProxyCommand in an... |
| CVE-2021-3148 |
Medium |
Yes |
Arbitrary command execution |
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command... |
| CVE-2021-3144 |
High |
Yes |
Insufficient validation |
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.) |
| CVE-2020-35662 |
High |
Yes |
Certificate verification bypass |
In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated. |
| CVE-2020-28972 |
High |
Yes |
Certificate verification bypass |
In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS... |
| CVE-2020-28243 |
High |
No |
Privilege escalation |
An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This... |