SaltStack Salt Path Traversal Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| salt | ≥ 3000, < 3000.2< 2019.2.4 | 3000.22019.2.4 |
| workspaces server | = 9.1.0≥ 8.0.0, ≤ 8.2.6≤ 7.1.3 | |
| salt | ≥ 3000, < 3000.2< 2019.2.4 | 3000.22019.2.4 |
| application remote collector | = 7.5.0= 8.0.0 |
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free