Back to CVE Browser

CVE-2020-16846

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score40.6510%

EPSS Percentile96.69th

Published2020-11-06

Last Modified2025-11-07

Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

Affected Platforms (CPE)

📦

Saltstack

Salt

< 2015.8.10>= 2015.8.11 and < 2015.8.13>= 2016.3.0 and < 2016.3.4>= 2016.3.5 and < 2016.3.6>= 2016.3.7 and < 2016.3.8>= 2016.11.0 and < 2016.11.3>= 2016.11.4 and < 2016.11.6>= 2016.11.7 and < 2016.11.10>= 2017.5.0 and < 2017.7.4>= 2017.7.5 and < 2017.7.8>= 2018.2.0 and < 2018.3.5>= 2019.2.0 and < 2019.2.5>= 3000.0 and < 3000.3= 3001= 3002

💻

Debian

Debian Linux

= 9.0= 10.0

💻

Fedoraproject

Fedora

= 31

💻

Opensuse

Leap

= 15.1

References & Advisories

🔗 http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html

🔗 http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html

🔗 https://github.com/saltstack/salt/releases

🔗 https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html

🔗 https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html

🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/

🔗 https://security.gentoo.org/glsa/202011-13

🔗 https://www.debian.org/security/2021/dsa-4837

Related Vulnerabilities

CVE-2026-573106.3

Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtai...

CVE-2026-162359.8

Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand fu...

SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL...

CVE-2026-145036.5

The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2....