An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
Published 2020-11-06 08:15:13
Updated 2022-02-22 10:09:25
Source MITRE
View at NVD,   CVE.org

CVE-2020-16846 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:
SaltStack Salt Shell Injection Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.
Added on 2021-11-03 Action due date 2022-05-03

Exploit prediction scoring system (EPSS) score for CVE-2020-16846

97.34%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-16846

  • SaltStack Salt REST API Arbitrary Command Execution
    Disclosure Date: 2020-11-03
    First seen: 2020-11-11
    exploit/linux/http/saltstack_salt_api_cmd_exec
    This module exploits an authentication bypass and command injection in SaltStack Salt's REST API to execute commands as the root user. The following versions have received a patch: 2015.8.10, 2015.8.13, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2016.11.6, 201

CVSS scores for CVE-2020-16846

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.5
HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
NIST
9.8
CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
NIST

CWE ids for CVE-2020-16846

References for CVE-2020-16846

Products affected by CVE-2020-16846

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!