CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2020-16846

CVSS 9.8v3.1pub. 2020-11-06upd. 2025-11-07

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Debian
OS
Debian
10.09.0
Fedora Project Fedora
OS
Fedoraproject
31
Opensuse Leap
OS
Opensuse
15.1
Saltstack Salt
APP
Saltstack
300130022016.11.4 – 2016.11.6 (bez)2016.11.7 – 2016.11.10 (bez)2017.5.0 – 2017.7.4 (bez)< 2015.8.102018.2.0 – 2018.3.5 (bez)2019.2.0 – 2019.2.5 (bez)3000.0 – 3000.3 (bez)2017.7.5 – 2017.7.8 (bez)2015.8.11 – 2015.8.13 (bez)2016.3.0 – 2016.3.4 (bez)2016.3.5 – 2016.3.6 (bez)2016.3.7 – 2016.3.8 (bez)2016.11.0 – 2016.11.3 (bez)

CISA KEV — detailsi

Vendori: SaltStack
Producti: Salt
Added to KEVi: November 3, 2021
Remediation deadline (US Federal)i: May 3, 2022(overdue)

🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.

🔴