CRITICAL🇬🇧 English

CVE-2021-25315

CVSS 9.8v3.1pub. 2021-03-03upd. 2024-11-21

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Opensuse Tumbleweed

    OS
    Opensuse
    wszystkie wersje

  • Saltstack Salt

    APP
    Saltstack
    < 3002.2

  • SUSE Linux Enterprise Server

    OS
    Suse
    15
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
RCEAuth Bypass
CWE
Referencje

Powiązane podatności

CVE-2020-16846CRITICAL9.8⚠ KEVten sam produkt

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the...

CVE-2020-11651CRITICAL9.8⚠ KEVten sam produkt

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process Clea...

CVE-2024-38824CRITICAL9.6PL ✓ten sam produkt

Path Traversal w SaltStack Salt – zapis dowolnych plików w katalogu cache mastera

CVE-2021-33226CRITICAL9.8ten sam produkt

Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the...

CVE-2022-28321CRITICAL9.8ten sam produkt

The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. Th...