PT-2024-4385 · Salt+3 · Salt+3

Chenwei Jiang + 1 · Published 2024-01-31 · Updated 2025-01-22 · CVE-2024-22232

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Salt (affected versions not specified)

Description The issue is related to the creation of specially crafted URLs, leading to directory traversal on the Salt file server. This can allow a malicious user to read arbitrary files from a Salt master's filesystem.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Information Disclosure

Weakness Enumeration

CWE-22

CWE-200

Related Identifiers

ALT-PU-2024-2460

ALT-PU-2024-4288

ALT-PU-2024-7869

ALT-PU-2024-8995

ALT-PU-2025-1673

BDU:2024-04877

CVE-2024-22232

GHSA-2QW3-2WV6-P64X

OPENSUSE-SU-2024_0509-1

OPENSUSE-SU-2024_0510-1

OPENSUSE-SU-2024_0513-1

SUSE-SU-2024:0506-1

SUSE-SU-2024:0507-1

SUSE-SU-2024:0508-1

SUSE-SU-2024:0509-1

SUSE-SU-2024:0510-1

SUSE-SU-2024:0513-1

SUSE-SU-2024:1517-1

SUSE-SU-2024:1518-1

SUSE-SU-2024:1525-1

Affected Products

Alt Linux

Red Os

Salt

Suse

References · 86

• https://osv.dev/vulnerability/SUSE-SU-2024:0507-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-22232 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1518-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-22232 · Security Note
• https://bdu.fstec.ru/vul/2024-04877 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:1525-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0509-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-22232 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0508-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22232 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:0510-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0513-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1517-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2qw3-2wv6-p64x · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0506-1 · Vendor Advisory