CVE-2020-11652mediumunder attackCWE-22

CVE-2020-11652

Published · Updated

Follow this CVE+ Monitor SaltStack+ Monitor salt

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 6.5epss 86%
from disclosure to weapon4 days
Published on NVDApr 30
1st PoC+4d
metasploitApr 30
CISA KEV+552d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product (2 components)
Red Hat Ceph Storage 2
workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

SaltStack Salt's master process allows authenticated users to access any directory on the server by exploiting improper path validation. This means someone with valid credentials can read or manipulate files they shouldn't have access to.

Technical detail

The ClearFuncs class in salt-master fails to properly sanitize file paths in certain methods, enabling authenticated users to perform directory traversal attacks (CWE-22). An attacker with valid authentication can access arbitrary files and directories on the master system, bypassing intended access restrictions.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.