high7.7
CVE-2024-22232
Path traversal in saltstack
Impact
A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | salt | < 3005.5 | 3005.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://saltproject.io/security-announcements/2024-01-31-advisory/
- https://github.com/advisories/GHSA-2qw3-2wv6-p64x
- https://nvd.nist.gov/vuln/detail/CVE-2024-22232
- https://saltproject.io/security-announcements/2024-01-31-advisory
- https://github.com/saltstack/salt/commit/e0cdb80b55123f4a024759ffcf2b3f0e0788e7ab