An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.
Priority CRITICAL 86Exploited in the wildCWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
Why it matters now
Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03
EPSS 0.86446 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial salt (PyPI): 2019.2.4, 3000.2Red Hat: 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | salt (PyPI) | before 2019.2.4 | 2019.2.4 | Patch available | GHSA-vp49-2g4r-m3x3 |
| — | salt (PyPI) | 3000 to before 3000.2 | 3000.2 | Patch available | GHSA-vp49-2g4r-m3x3 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- salt (PyPI) Vendor— Affected before 2019.2.4 Fixed in 2019.2.4 Patch available GHSA-vp49-2g4r-m3x3
- salt (PyPI) Vendor— Affected 3000 to before 3000.2 Fixed in 3000.2 Patch available GHSA-vp49-2g4r-m3x3
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* | before 2019.2.4; 3000 to before 3000.2 | Vulnerable | SaltStack |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:a:blackberry:workspaces_server:*:*:*:*:*:*:*:* | up to 7.1.3; 8.0.0 – 8.2.6 | Vulnerable | BlackBerry |
| cpe:2.3:a:blackberry:workspaces_server:9.1.0:*:*:*:*:*:*:* | 9.1.0 | Vulnerable | BlackBerry |
| cpe:2.3:a:vmware:application_remote_collector:7.5.0:*:*:*:*:*:*:* | 7.5.0 | Vulnerable | VMware |
- cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* Versions before 2019.2.4; 3000 to before 3000.2 Vulnerable ·SaltStack
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:a:blackberry:workspaces_server:*:*:*:*:*:*:*:* Versions up to 7.1.3; 8.0.0 – 8.2.6 Vulnerable ·BlackBerry
- cpe:2.3:a:blackberry:workspaces_server:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·BlackBerry
- cpe:2.3:a:vmware:application_remote_collector:7.5.0:*:*:*:*:*:*:* Versions 7.5.0 Vulnerable ·VMware
Remediation
- Fix · GHSA-vp49-2g4r-m3x3 salt (PyPI) Fixed in 2019.2.4 Advisory →
- Fix · GHSA-vp49-2g4r-m3x3 salt (PyPI) Fixed in 3000.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 2 | Affected | No fix planned: Will not fix |
Timeline
- 2021-11-03 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2020-11652
- 2026-10-03 Alias added: GHSA-vp49-2g4r-m3x3
References
Advisory 12
- https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html
- https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst
- openSUSE-SU-2020:0564
- http://packetstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.html
- DSA-4676
- http://www.vmware.com/security/advisories/VMSA-2020-0009.html
- 20200528 SaltStack FrameWork Vulnerabilities Affecting Cisco Products
- [debian-lts-announce] 20200530 [SECURITY] [DLA 2223-1] salt security update
- http://support.blackberry.com/kb/articleDetail?articleNumber=000063758
- openSUSE-SU-2020:1074
- USN-4459-1
- https://nvd.nist.gov/vuln/detail/CVE-2020-11652
More SaltStack Salt vulnerabilities
- TI-2020-12851 An issue was discovered in SaltStack Salt through 3002. KEVCVSS 3.1CRITICAL 9.8
- TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
- TI-2021-07530 An issue was discovered in through SaltStack Salt before 3002.5. CVSS 3.1CRITICAL 9.8
- TI-2021-07531 An issue was discovered in through SaltStack Salt before 3002.5. CVSS 3.1CRITICAL 9.1
- TI-2021-12769 Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute… CVSS 3.1CRITICAL 9.8
- TI-2021-02271 An issue was discovered in SaltStack Salt before 3002.5. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-11652 · CVE Program
- CVE-2020-11652 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-vp49-2g4r-m3x3 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-11652 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences