SaltStack Salt Authentication Bypass Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| salt | ≥ 3000, < 3000.2< 2019.2.4 | 3000.22019.2.4 |
| salt | ≥ 3000, < 3000.2< 2019.2.4 | 3000.22019.2.4 |
| application remote collector | = 7.5.0= 8.0.0 |
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free