CyberSec.Space Logo
Back to CVE Browser

CVE-2020-16846

Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
EPSS Score40.6510%
EPSS Percentile96.69th
PublishedNov 6, 2020
Last ModifiedNov 7, 2025

Vulnerability Description

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

Affected Platforms (CPE)

📦
Saltstack

Salt

< 2015.8.10
📦
Saltstack

Salt

>= 2015.8.11 and < 2015.8.13
📦
Saltstack

Salt

>= 2016.3.0 and < 2016.3.4
📦
Saltstack

Salt

>= 2016.3.5 and < 2016.3.6
📦
Saltstack

Salt

>= 2016.3.7 and < 2016.3.8
📦
Saltstack

Salt

>= 2016.11.0 and < 2016.11.3
📦
Saltstack

Salt

>= 2016.11.4 and < 2016.11.6
📦
Saltstack

Salt

>= 2016.11.7 and < 2016.11.10
📦
Saltstack

Salt

>= 2017.5.0 and < 2017.7.4
📦
Saltstack

Salt

>= 2017.7.5 and < 2017.7.8
📦
Saltstack

Salt

>= 2018.2.0 and < 2018.3.5
📦
Saltstack

Salt

>= 2019.2.0 and < 2019.2.5
📦
Saltstack

Salt

>= 3000.0 and < 3000.3
📦
Saltstack

Salt

= 3001
📦
Saltstack

Salt

= 3002
💻
Debian

Debian Linux

= 9.0
💻
Debian

Debian Linux

= 10.0
💻
Fedoraproject

Fedora

= 31
💻
Opensuse

Leap

= 15.1

References & Advisories

🔗 http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html
🔗 http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html
🔗 https://github.com/saltstack/salt/releases
🔗 https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html
🔗 https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/
🔗 https://security.gentoo.org/glsa/202011-13
🔗 https://www.debian.org/security/2021/dsa-4837

Related Vulnerabilities

CVE-2011-326810.0

Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a l...

CVE-2013-443710.0

Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage...

CVE-2001-135610.0

NetWin SurgeFTP 2.0f and earlier encrypts passwords using weak hashing, a fixed salt value and modulo 40 calculations, which allow...

CVE-2013-661710.0

The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for r...