VDB

CVE-2021-25315

CVE-2021-25315 PUBLISHED CVSS 7.800000190734863 HIGH

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.

EPSS 2.33% · 82.9th percentile

Risk Scores

CVSS 3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
2.33%
82.9th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:14.04:LTSsalt0, 0.16.0-1, *
Ubuntu:22.04:LTSsalt0, *, 3002.6+dfsg1-4
Ubuntu:Pro:16.04:LTSsalt2015.8.5+ds-1, 2015.8.3+ds-2, 2015.8.1+ds-2
Ubuntu:Pro:18.04:LTSsalt0, *, *

Timeline

  • Mar 3, 2021 CVE Published
  • Mar 3, 2021 PoC Published
  • Mar 17, 2021 PoC Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Aug 25, 2021 EPSS Score
  • Dec 28, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Mar 1, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 3, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›