NetSight
IP …
critical9.8Known exploited

CVE-2020-16846

SaltStack Salt Shell Injection Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.

Apply updates per vendor instructions.

Impact

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

Affected products

VendorProductAffected versions
SaltstackSalt
before 2015.8.10
from 2015.8.11 before 2015.8.13
from 2016.3.0 before 2016.3.4
from 2016.3.5 before 2016.3.6
from 2016.3.7 before 2016.3.8
from 2016.11.0 before 2016.11.3
DebianDebian Linux
Versions 9.0, 10.0
FedoraprojectFedora
Version 31
OpensuseLeap
Version 15.1

Weakness classification

CWE-78

References