CISA KEV 정보
| 취약점명 | SaltStack Salt Shell Injection Vulnerability |
|---|---|
| 설명 | SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API. |
| 조치사항 | Apply updates per vendor instructions. |
| 랜섬웨어 캠페인 악용 | Unknown |
| CWE | CWE-78 |
| 등록일 (KEV) | 2021-11-03 |
| 조치 기한 | 2022-05-03 |
| 추가 참고 | https://nvd.nist.gov/vuln/detail/CVE-2020-16846 |
NVD 상세 정보
CVSS v3.1: 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS v2.0: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P설명: An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
CWE: CWE-78 | CWE-78
참조
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html [Mailing List, Third Party Advisory]
- http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html [Exploit, Third Party Advisory, VDB Entry]
- https://github.com/saltstack/salt/releases [Release Notes]
- https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html [Mailing List, Third Party Advisory]
- https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html [Mailing List, Third Party Advisory]
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/ [Release Notes]
- https://security.gentoo.org/glsa/202011-13 [Third Party Advisory]
- https://www.debian.org/security/2021/dsa-4837 [Mailing List, Third Party Advisory]
- https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/ [Broken Link, Vendor Advisory]
- https://www.zerodayinitiative.com/advisories/ZDI-20-1379/ [Third Party Advisory, VDB Entry]
- https://www.zerodayinitiative.com/advisories/ZDI-20-1380/ [Third Party Advisory, VDB Entry]
- https://www.zerodayinitiative.com/advisories/ZDI-20-1381/ [Third Party Advisory, VDB Entry]
- https://www.zerodayinitiative.com/advisories/ZDI-20-1382/ [Third Party Advisory, VDB Entry]
- https://www.zerodayinitiative.com/advisories/ZDI-20-1383/ [Third Party Advisory, VDB Entry]
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html [Mailing List, Third Party Advisory]
- ... 외 14건
This product uses the NVD API but is not endorsed or certified by the NVD.