Show filters
2 Total Results
Displaying 1-2 of 2
Sort by:
Attacker Value
Very High

CVE-2020-16846 — SaltStack Unauthenticated Shell Injection

Disclosure Date: November 06, 2020 (last updated November 08, 2023)
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
Attacker Value
Very High

CVE-2020-25592 — SaltStack Authentication Bypass and Salt SSH Command Execution

Disclosure Date: November 06, 2020 (last updated November 08, 2023)
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.