VDB

CVE-2020-28243

CVE-2020-28243 PUBLISHED

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.

EPSS 1.41% · 80.9th percentile

Risk Scores

EPSS Score
1.41%
80.9th percentile

Affected Products

VendorProductVersions
Ubuntu:22.04:LTSsalt3004.1+dfsg-2, 3004+dfsg1-8, 3004+dfsg1-7
Ubuntu:Pro:18.04:LTSsalt0, 2016.11.5+ds-1, 2016.11.8+dfsg1-1
Ubuntu:Pro:14.04:LTSsalt0.17.5+ds-1ubuntu0.1~esm1, 0.17.5+ds-1ubuntu0.1~esm2, 0.17.5+ds-1ubuntu0.1~esm4

Exploit Intelligence

…and 40 more exploits

Timeline

  • Feb 26, 2021 CVE Published
  • Mar 31, 2021 PoC Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Dec 27, 2021 EPSS Score
  • Feb 28, 2022 EPSS Score
  • Jul 3, 2022 EPSS Score
  • Sep 4, 2022 EPSS Score
  • Nov 6, 2022 EPSS Score
  • Mar 7, 2023 EPSS Score
  • Mar 11, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›