VDB
CVE-2020-16846
CVE-2020-16846
PUBLISHED
KEV
CVSS 9.800000190734863 CRITICAL
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
EPSS 99.59% · 99.9th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
99.59%
99.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:Pro:16.04:LTS | salt | 2015.8.3+ds-3, 2015.8.5+ds-1, 2015.8.8+ds-1 |
| Ubuntu:Pro:18.04:LTS | salt | 2017.7.2+dfsg1-2ubuntu1, 2017.7.3+dfsg1-1, 2017.7.4+dfsg1-1 |
| Ubuntu:Pro:14.04:LTS | salt | 0.16.0-1, 0.17.1+dfsg-1, 0.17.2-1 |
Timeline
- Nov 3, 2020 CVE Published
- Nov 11, 2020 PoC Published
- Nov 12, 2020 PoC Published
- Apr 14, 2021 EPSS Score
- Apr 24, 2021 VulnCheck KEV Exploitation
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Sep 22, 2021 VulnCheck KEV Exploitation
- Oct 26, 2021 EPSS Score
- Nov 3, 2021 CISA KEV Added
- Nov 3, 2021 VulnCheck KEV Exploitation
- Nov 8, 2021 PoC Published
References
- Nuclei Template exploit
- https://ubuntu.com/security/CVE-2020-16846 third-party-advisory
- https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/ third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2020-16846 third-party-advisory
- https://ubuntu.com/security/notices/USN-6948-1 vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog third-party-advisory
- https://ubuntu.com/security/notices/USN-7181-1 vendor-advisory