Lucene search
Alpine Linux Development TeamALPINE:CVE-2020-11652HistoryApr 30, 2020 - 5:15 p.m.
CVE-2020-11652
2020-04-3017:15:12
Alpine Linux Development Team
security.alpinelinux.org
39
CVSS2
4
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS3
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
AI Score
8.2
Confidence
High
EPSS
0.972
Percentile
99.8%
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Alpine | edge-community | noarch | salt | < 3000.2-r0 | UNKNOWN |
| Alpine | 3.10-community | noarch | salt | < 2019.2.4-r0 | UNKNOWN |
| Alpine | 3.11-community | noarch | salt | < 2019.2.4-r0 | UNKNOWN |
| Alpine | 3.12-community | noarch | salt | < 3000.2-r0 | UNKNOWN |
| Alpine | 3.13-community | noarch | salt | < 3000.2-r0 | UNKNOWN |
| Alpine | 3.14-community | noarch | salt | < 3000.2-r0 | UNKNOWN |
| Alpine | 3.15-community | noarch | salt | < 3000.2-r0 | UNKNOWN |
| Alpine | 3.16-community | noarch | salt | < 3000.2-r0 | UNKNOWN |
| Alpine | 3.17-community | noarch | salt | < 3000.2-r0 | UNKNOWN |
| Alpine | 3.18-community | noarch | salt | < 3000.2-r0 | UNKNOWN |
Related
osv
osv
SaltStack Salt is vulnerable Arbitrary Directory Access
2022-05-24 17:16:58
CVE-2020-11652
2020-04-30 17:15:12
PYSEC-2020-103
2020-04-30 17:15:00
cvelist
cvelist
CVE-2020-11652
2020-04-30 17:00:03
cisa_kev
cisa_kev
SaltStack Salt Path Traversal Vulnerability
2021-11-03 00:00:00
prion
prion
Improper access control
2020-04-30 17:15:00
ubuntucve
ubuntucve
CVE-2020-11652
2020-04-30 00:00:00
veracode
veracode
Arbitrary Directory Access
2020-05-04 04:38:10
debiancve
debiancve
CVE-2020-11652
2020-04-30 17:15:12
nvd
nvd
CVE-2020-11652
2020-04-30 17:15:12
github
github
SaltStack Salt is vulnerable Arbitrary Directory Access
2022-05-24 17:16:58
redhatcve
redhatcve
CVE-2020-11652
2020-05-06 17:40:11
cve
cve
CVE-2020-11652
2020-04-30 17:15:12
thn
thn
nessus
nessus
SUSE SLES15 Security Update : salt (SUSE-SU-2020:1151-1)
2020-04-30 00:00:00
Photon OS 1.0: Salt PHSA-2020-1.0-0294
2020-05-18 00:00:00
SUSE SLED15 / SLES15 Security Update : salt (SUSE-SU-2020:1150-1)
2020-04-30 00:00:00
zdt
zdt
Saltstack 3000.1 Remote Code Execution Exploit
2020-05-07 00:00:00
SaltStack Salt Master/Minion Unauthenticated Remote Code Execution Exploit
2020-05-12 00:00:00
Saltstack 3000.1 - Remote Code Execution Exploit
2020-05-04 00:00:00
debian
debian
[SECURITY] [DSA 4676-2] salt security update
2020-05-07 20:16:07
[SECURITY] [DLA 2223-1] salt security update
2020-05-30 04:21:15
[SECURITY] [DSA 4676-2] salt security update
2020-05-07 20:16:07
githubexploit
githubexploit
Exploit for Missing Authentication for Critical Function in Saltstack Salt
2020-05-01 03:23:01
Exploit for Missing Authentication for Critical Function in Saltstack Salt
2020-05-04 11:52:28
Exploit for Missing Authentication for Critical Function in Saltstack Salt
2020-05-01 20:53:49
metasploit
metasploit
SaltStack Salt Master/Minion Unauthenticated RCE
2020-05-11 17:05:38
SaltStack Salt Master Server Root Key Disclosure
2020-05-11 17:05:38
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2020:1150-1)
2021-06-09 00:00:00
Debian: Security Advisory (DLA-2223-1)
2020-05-31 00:00:00
Ubuntu: Security Advisory (USN-6849-1)
2024-06-26 00:00:00
freebsd
freebsd
salt -- multiple vulnerabilities in salt-master process
2020-04-30 00:00:00
ubuntu
ubuntu
Salt vulnerabilities
2024-06-25 00:00:00
Salt vulnerabilities
2020-08-13 00:00:00
trendmicroblog
trendmicroblog
archlinux
archlinux
[ASA-202005-1] salt: multiple issues
2020-05-05 00:00:00
cisco
cisco
SaltStack FrameWork Vulnerabilities Affecting Cisco Products
2020-05-28 16:00:00
suse
suse
Security update for salt (critical)
2020-04-30 00:00:00
Security update for salt (moderate)
2020-07-26 00:00:00
Security update for salt (critical)
2021-07-11 00:00:00
vmware
vmware
checkpoint_advisories
checkpoint_advisories
Saltstack Salt Authentication Bypass (CVE-2020-11651; CVE-2020-11652)
2020-05-05 00:00:00
packetstorm
packetstorm
SaltStack Salt Master Server Root Key Disclosure
2024-08-31 00:00:00
Saltstack 3000.1 Remote Code Execution
2020-05-05 00:00:00
SaltStack Salt Master/Minion Unauthenticated Remote Code Execution
2020-05-12 00:00:00
attackerkb
attackerkb
CVE-2020-11652
2020-04-30 00:00:00
CVE-2020-11651
2020-04-30 00:00:00
huawei
huawei
Security Advisory - Two Vulnerabilities in SaltStack Salt
2020-07-15 00:00:00
exploitdb
exploitdb
Saltstack 3000.1 - Remote Code Execution
2020-05-05 00:00:00
threatpost
threatpost
Hackers Exploit Critical Flaw in Ghost Platform with Cryptojacking Attack
2020-05-04 19:23:41
Salt Bugs Allow Full RCE as Root on Cloud Servers
2020-04-30 20:54:50
Hackers Compromise Cisco Servers Via SaltStack Flaws
2020-05-28 20:51:25
cisa
cisa
SaltStack Patches Critical Vulnerabilities in Salt
2020-05-01 00:00:00
photon
photon
Critical Photon OS Security Update - PHSA-2020-0091
2020-05-15 00:00:00
Home
Download Photon OS
User Documentation
FAQ
Security Advisories
Related Information
Lightwave - PHSA-2020-1.0-0294
2020-05-14 00:00:00
Critical Photon OS Security Update - PHSA-2020-3.0-0091
2020-05-15 00:00:00
CVSS2
4
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS3
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
AI Score
8.2
Confidence
High
EPSS
0.972
Percentile
99.8%
Related for ALPINE:CVE-2020-11652