PT-2025-25392 · Saltstack+3 · Saltstack+3

Published

2025-01-02

·

Updated

2025-08-19

·

CVE-2025-22237

CVSS v3.1

6.7

Medium

VectorAV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions The product name cannot be determined.
Description An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url, which could cause an arbitrary command to be run on the master with the same privileges as the master process.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

Related Identifiers

ALT-PU-2025-8072
ALT-PU-2025-8965
BDU:2025-10845
CVE-2025-22237
GHSA-FCR4-H6C4-RVVP
OPENSUSE-SU-2025:15295-1
SUSE-SU-2025:02476-1
SUSE-SU-2025:02491-1
SUSE-SU-2025:02492-1
SUSE-SU-2025:02499-1
SUSE-SU-2025:02500-1
SUSE-SU-2025:02501-1
SUSE-SU-2025:02502-1
SUSE-SU-2025:02534-1
SUSE-SU-2025:20487-1
SUSE-SU-2025:20504-1
SUSE-SU-2025_02500-1
SUSE-SU-2025_02501-1
SUSE-SU-2025_02534-1

Affected Products

Alt Linux
Red Os
Saltstack
Suse