CVE-2020-11651
Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
Vulnerability Description
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
Affected Platforms (CPE)
📦
Saltstack
Salt
< 2019.2.4📦
Saltstack
Salt
>= 3000 and < 3000.2💻
Opensuse
Leap
= 15.1💻
Debian
Debian Linux
= 8.0💻
Debian
Debian Linux
= 9.0💻
Debian
Debian Linux
= 10.0💻
Canonical
Ubuntu Linux
= 16.04💻
Canonical
Ubuntu Linux
= 18.04📦
Vmware
Application Remote Collector
= 7.5.0📦
Vmware