{"id":"CVE-2018-15751","published":"2018-10-24T22:00:00Z","modified":"2024-08-05T10:01:54Z","title":"SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and…","vendor":null,"product":null,"tier":"tail","description":{"text":"SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04902,"percentile":0.92034,"provenance":"source"},"cwes":[],"references":[{"url":"https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html","tags":["x_refsource_CONFIRM"]},{"url":"https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html","tags":["x_refsource_CONFIRM"]},{"url":"https://groups.google.com/d/msg/salt-users/L9xqcJ0UXxs/qgDj42obBQAJ","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://groups.google.com/d/msg/salt-users/dimVF7rpphY/jn3Xv3MbBQAJ","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00024.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://usn.ubuntu.com/4459-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]}],"priority":{"score":18.4,"factors":[{"name":"EPSS percentile","points":18.41}]},"affected":[{"ecosystem":"PyPI","package":"salt","vulnerableRanges":[">=2017.7.0, <2017.7.8",">=2018.3.0, <2018.3.3",">=2016.11.0, <2016.11.10","<2017.7.8"],"patched":["2017.7.8","2018.3.3","2016.11.10"],"from":["GHSA-x549-r7m8-gv63","PYSEC-2018-30"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0134","exploited":false,"provenance":"source"}}