CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2020-11651

CVSS 9.8v3.1pub. 2020-04-30upd. 2025-11-07

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Canonical Ubuntu
OS
Canonical
16.0418.04
Debian
OS
Debian
10.08.09.0
Opensuse Leap
OS
Opensuse
15.1
Saltstack Salt
APP
Saltstack
< 2019.2.43000 – 3000.2 (bez)
VMware Application Remote Collector
APP
Vmware
7.5.08.0.0

CISA KEV — detailsi

Vendori: SaltStack
Producti: Salt
Added to KEVi: November 3, 2021
Remediation deadline (US Federal)i: May 3, 2022(overdue)

🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/or run commands on salt minions. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.

🔴