Show filters
2 Total Results
Displaying 1-2 of 2
Sort by:
Attacker Value
Very High
CVE-2020-16846 — SaltStack Unauthenticated Shell Injection
Disclosure Date: November 06, 2020 (last updated July 27, 2024)
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
1
Attacker Value
Very High
CVE-2020-25592 — SaltStack Authentication Bypass and Salt SSH Command Execution
Disclosure Date: November 06, 2020 (last updated November 08, 2023)
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.
4
