PT-2018-3609 · Saltstack+3 · Saltstack Salt+3
Publicado
2017-12-14
·
Atualizado
2022-05-13
·
CVE-2018-15750
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
SaltStack Salt versions 2016.11.x through 2016.11.10
SaltStack Salt versions 2017.7.x through 2017.7.8
SaltStack Salt versions 2018.3.x through 2018.3.3
Description
The issue is related to a Directory Traversal vulnerability in the salt-api component of SaltStack Salt. This vulnerability allows remote attackers to determine which files exist on the server. The vulnerability is caused by incorrect restriction of the directory path name, which can be exploited by a remote attacker to access confidential data.
Recommendations
For SaltStack Salt versions 2016.11.x through 2016.11.10, update to version 2016.11.10 or later.
For SaltStack Salt versions 2017.7.x through 2017.7.8, update to version 2017.7.8 or later.
For SaltStack Salt versions 2018.3.x through 2018.3.3, update to version 2018.3.3 or later.
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Saltstack Salt
Suse
Ubuntu