Read the docs
TI-2021-07554 Aliases CVE-2021-25315GHSA-pmj6-9f8c-8g2m

salt-api unauthenticated remote code execution

Priority MEDIUM 46CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.

Why it matters now

EPSS 0.02289 83rd percentileScored 2026-11-07
Fix Partial SUSE Linux Enterprise Server 15 SP 3 (SUSE): 3002.2-3salt (PyPI): 3002.2Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSESUSE Linux Enterprise Server 15 SP 3salt to before 3002.2-33002.2-3Patch availableCNA
openSUSETumbleweedsalt – 3002.2-2.1—No fix listedCNA
—salt (PyPI)before 3002.23002.2Patch availableGHSA-pmj6-9f8c-8g2m
  • SUSE Linux Enterprise Server 15 SP 3 VendorSUSE Affected salt to before 3002.2-3 Fixed in 3002.2-3 Patch available CNA
  • Tumbleweed VendoropenSUSE Affected salt – 3002.2-2.1 Fixed in — No fix listed CNA
  • salt (PyPI) Vendor— Affected before 3002.2 Fixed in 3002.2 Patch available GHSA-pmj6-9f8c-8g2m

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*before 3002.2VulnerableSaltStack
cpe:2.3:o:opensuse:tumbleweed:-:*:*:*:*:*:*:*not specified by NVDRunning onopenSUSE
cpe:2.3:o:suse:suse_linux_enterprise_server:15:sp3:*:*:*:*:*:*15 sp3Running onSUSE
  • cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* Versions before 3002.2 Vulnerable ·SaltStack
  • cpe:2.3:o:opensuse:tumbleweed:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·openSUSE
  • cpe:2.3:o:suse:suse_linux_enterprise_server:15:sp3:*:*:*:*:*:* Versions 15 sp3 Running on ·SUSE

Remediation

  • Fix · CNA SUSE Linux Enterprise Server 15 SP 3 (SUSE) Fixed in 3002.2-3
  • Fix · GHSA-pmj6-9f8c-8g2m salt (PyPI) Fixed in 3002.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-25315
  2. 2026-10-03 Alias added: GHSA-pmj6-9f8c-8g2m

References

Advisory 2

Other 2

  • TI-2016-03560 Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-03506 Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04302 Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04301 Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04298 Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
See all 1331 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences