ZeusQA
Start free

Known exploited vulnerabilities

SaltStack vulnerabilities attackers have used

Every SaltStack vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 3 SaltStack vulnerabilities as exploited in the wild, 0 of them added in the last 12 months. The most recent is CVE-2020-16846, added Nov 3, 2021. Salt has the most entries (3).

In KEV, all time
3
Added, last 12 months
0
Used in ransomware
0
New CVEs this week
0

Every SaltStack entry in CISA KEV

  1. CVE-2020-16846

    Added · due

    SaltStack Salt Shell Injection Vulnerability

    SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.

  2. CVE-2020-11652

    Added · due

    SaltStack Salt Path Traversal Vulnerability

    SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not…

  3. CVE-2020-11651

    Added · due

    SaltStack Salt Authentication Bypass Vulnerability

    SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can…

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works