| Vulnerability Name: | CVE-2013-4435 (CCN-88296) | ||||||||
| Assigned: | 2013-10-12 | ||||||||
| Published: | 2013-10-12 | ||||||||
| Updated: | 2013-11-07 | ||||||||
| Summary: | Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine. | ||||||||
| CVSS v3 Severity: | 4.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 6.0 Medium (CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P) 4.4 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)
4.4 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-287 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2013-4435 Source: CCN Type: Salt Web Site Salt 0.17.1 Release Notes Source: CONFIRM Type: Patch, Vendor Advisory http://docs.saltstack.com/topics/releases/0.17.1.html Source: CCN Type: oss-sec Mailing List, Tue, 15 Oct 2013 23:54:03 -0600 Re: CVE request for saltstack minion identity usurpation Source: CCN Type: oss-sec Mailing List, Tue, 15 Oct 2013 23:54:42 -0600 Re: CVE request for saltstack minion identity usurpation Source: CCN Type: oss-sec Mailing List, Wed, 16 Oct 2013 00:20:08 -0600 Re: CVE request for saltstack minion identity usurpation Source: CCN Type: oss-sec Mailing List, Fri, 18 Oct 2013 13:59:37 -0600 Re: CVE request for saltstack minion identity usurpation Source: CCN Type: oss-sec Mailing List, Sat, 12 Oct 2013 00:26:09 +0200 CVE request for saltstack minion identity usurpation Source: CCN Type: SA55625 Salt Multiple Vulnerabilities Source: MLIST Type: UNKNOWN [oss-security] 20131018 Re: CVE request for saltstack minion identity usurpation Source: CCN Type: BID-63240 SaltStack Salt CVE-2013-4435 Multiple Command Injection Vulnerabilities Source: XF Type: UNKNOWN salt-modules-cve-20134435-unspecified(88296) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||