SaltStack Salt Path Traversal Vulnerability
SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.
- Vendor
- SaltStack
- Product
- Salt
- CVSS
- 6.5
- EPSS (exploit probability)
- 86.2%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.
Added to CISA’s Known Exploited Vulnerabilities catalog on 2021-11-03. Required action per CISA: Apply updates per vendor instructions. Due date: 2022-05-03.
This is an auto-synced KEV catalog record pending a full 0dayNews write-up — see CISA’s KEV catalog and the NVD record linked above for primary sources.