CVE-2013-4435
medium
CVSS v3
—
CVSS v2
6.0
VIR risk
6.0
Description
Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: secalert@redhat.com — http://docs.saltstack.com/topics/releases/0.17.1.html
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| PyPI | salt | >=0.15.0,<0.17.1 | 0.17.1 |
References
- http://docs.saltstack.com/topics/releases/0.17.1.html
- http://www.openwall.com/lists/oss-security/2013/10/18/3
- https://nvd.nist.gov/vuln/detail/CVE-2013-4435
- https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2013-12.yaml
- https://github.com/saltstack/salt
- https://github.com/saltstack/salt/blob/master/doc/topics/releases/0.17.1.rst
CWEs
CWE-287
Verify integrity in audit chain (admin only). AS-IS.