CVE-2021-25315

CRITICAL

salt-api unauthenticated remote code execution

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-25315 has a selected CVSS score of 9.8 (critical).

Description

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.

Description source: CVE List

Affected products and versions

3
ProductSourceVersion range

SUSE Linux Enterprise Server 15 SP 3

Browse SUSE / SUSE Linux Enterprise Server 15 SP 3
CVE Listsalt to < 3002.2-3affected

Tumbleweed

Browse openSUSE / Tumbleweed
CVE Listsalt to ≤ 3002.2-2.1affected

salt

Browse PyPI / salt
GitHub AdvisoryBefore 3002.2 · Fixed in 3002.2affected

References

4