VDB

CVE-2017-5192

CVE-2017-5192 PUBLISHED CVSS 8.800000190734863 HIGH

When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed. The LocalClient.cmd_batch() method client does not accept external_auth credentials and so access to it from salt-api has been removed for now. This vulnerability allows code execution for already-authenticated users and is only in effect when running salt-api as the root user.

EPSS 1.64% · 74.4th percentile

Risk Scores

CVSS 3.0
8.800000190734863
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
1.64%
74.4th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:16.04:LTSsalt0, 2015.5.3+ds-1, 2015.8.1+ds-2
Ubuntu:Pro:14.04:LTSsalt0.16.4-2, 0.17.1+dfsg-1, 0.17.2-1

Timeline

  • Sep 26, 2017 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Aug 25, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Dec 28, 2021 EPSS Score
  • Mar 1, 2022 EPSS Score
  • May 3, 2022 EPSS Score
  • Jul 4, 2022 EPSS Score
  • Nov 8, 2022 EPSS Score
  • Jan 10, 2023 EPSS Score
  • Mar 7, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›