Read the docs
TI-2020-06498 Aliases CVE-2020-8028GHSA-pmmp-f225-r347

salt-api is accessible to every user on SUSE Manager Server

Priority MEDIUM 40CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

A Improper Access Control vulnerability in the configuration of salt of SUSE Linux Enterprise Module for SUSE Manager Server 4.1, SUSE Manager Proxy 4.0, SUSE Manager Retail Branch Server 4.0, SUSE Manager Server 3.2, SUSE Manager Server 4.0 allows local users to escalate to root on every system managed by SUSE manager. On the managing node itself code can be executed as user salt, potentially allowing for escalation to root there. This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.1 google-gson versions prior to 2.8.5-3.4.3, httpcomponents-client-4.5.6-3.4.2, httpcomponents-. SUSE Manager Proxy 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Retail Branch Server 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Server 3.2 salt-netapi-client versions prior to 0.16.0-4.14.1, spacewalk-. SUSE Manager Server 4.0 release-notes-susemanager versions prior to 4.0.9-3.54.1.

Why it matters now

EPSS 0.00403 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (SUSE): 0.17.0-3.3.2SUSE Manager Server 3.2 (SUSE): 0.16.0-4.14.1+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSESUSE Linux Enterprise Module for SUSE Manager Server 4.1salt-netapi-client to before 0.17.0-3.3.20.17.0-3.3.2Patch availableCNA
SUSESUSE Manager Server 3.2salt-netapi-client to before 0.16.0-4.14.10.16.0-4.14.1Patch availableCNA
SUSESUSE Manager Server 4.0salt-netapi-client to before 0.17.0-4.6.30.17.0-4.6.3Patch availableCNA
  • SUSE Linux Enterprise Module for SUSE Manager Server 4.1 VendorSUSE Affected salt-netapi-client to before 0.17.0-3.3.2 Fixed in 0.17.0-3.3.2 Patch available CNA
  • SUSE Manager Server 3.2 VendorSUSE Affected salt-netapi-client to before 0.16.0-4.14.1 Fixed in 0.16.0-4.14.1 Patch available CNA
  • SUSE Manager Server 4.0 VendorSUSE Affected salt-netapi-client to before 0.17.0-4.6.3 Fixed in 0.17.0-4.6.3 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:suse:salt-netapi-client:*:*:*:*:*:*:*:*before 0.17.0-3.3.2VulnerableSUSE
cpe:2.3:a:suse:manager_server:4.1:*:*:*:*:*:*:*4.1Running onSUSE
cpe:2.3:a:suse:salt-netapi-client:*:*:*:*:*:*:*:*before 0.16.0-4.14.1VulnerableSUSE
cpe:2.3:a:suse:manager_server:3.2:*:*:*:*:*:*:*3.2Running onSUSE
cpe:2.3:a:suse:salt-netapi-client:*:*:*:*:*:*:*:*before 0.17.0-4.6.3VulnerableSUSE
cpe:2.3:a:suse:manager_server:4.0:*:*:*:*:*:*:*4.0Running onSUSE
  • cpe:2.3:a:suse:salt-netapi-client:*:*:*:*:*:*:*:* Versions before 0.17.0-3.3.2 Vulnerable ·SUSE
  • cpe:2.3:a:suse:manager_server:4.1:*:*:*:*:*:*:* Versions 4.1 Running on ·SUSE
  • cpe:2.3:a:suse:salt-netapi-client:*:*:*:*:*:*:*:* Versions before 0.16.0-4.14.1 Vulnerable ·SUSE
  • cpe:2.3:a:suse:manager_server:3.2:*:*:*:*:*:*:* Versions 3.2 Running on ·SUSE
  • cpe:2.3:a:suse:salt-netapi-client:*:*:*:*:*:*:*:* Versions before 0.17.0-4.6.3 Vulnerable ·SUSE
  • cpe:2.3:a:suse:manager_server:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·SUSE

Remediation

  • Fix · CNA SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (SUSE) Fixed in 0.17.0-3.3.2
  • Fix · CNA SUSE Manager Server 3.2 (SUSE) Fixed in 0.16.0-4.14.1
  • Fix · CNA SUSE Manager Server 4.0 (SUSE) Fixed in 0.17.0-4.6.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8028
  2. 2026-10-03 Alias added: GHSA-pmmp-f225-r347

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences