CVE-2013-4435

2013-11-0518:55:04

CWE-287

redhat

web.nvd.nist.gov

cve

salt

saltstack

nvd

remote authentication

routine execution

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

AI Score

6.7

Confidence

Low

EPSS

0.002

Percentile

61.6%

JSON

Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.

Affected configurations

Nvd

Node

saltstacksaltMatch0.15.0

saltstacksaltMatch0.15.1

saltstacksaltMatch0.16.0

saltstacksaltMatch0.16.2

saltstacksaltMatch0.16.3

saltstacksaltMatch0.16.4

saltstacksaltMatch0.17.0

VendorProductVersionCPE
saltstacksalt0.15.0cpe:2.3:a:saltstack:salt:0.15.0:*:*:*:*:*:*:*
saltstacksalt0.15.1cpe:2.3:a:saltstack:salt:0.15.1:*:*:*:*:*:*:*
saltstacksalt0.16.0cpe:2.3:a:saltstack:salt:0.16.0:*:*:*:*:*:*:*
saltstacksalt0.16.2cpe:2.3:a:saltstack:salt:0.16.2:*:*:*:*:*:*:*
saltstacksalt0.16.3cpe:2.3:a:saltstack:salt:0.16.3:*:*:*:*:*:*:*
saltstacksalt0.16.4cpe:2.3:a:saltstack:salt:0.16.4:*:*:*:*:*:*:*
saltstacksalt0.17.0cpe:2.3:a:saltstack:salt:0.17.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
saltstack	salt	0.15.0	cpe:2.3:a:saltstack:salt:0.15.0:::::::*
saltstack	salt	0.15.1	cpe:2.3:a:saltstack:salt:0.15.1:::::::*
saltstack	salt	0.16.0	cpe:2.3:a:saltstack:salt:0.16.0:::::::*
saltstack	salt	0.16.2	cpe:2.3:a:saltstack:salt:0.16.2:::::::*
saltstack	salt	0.16.3	cpe:2.3:a:saltstack:salt:0.16.3:::::::*
saltstack	salt	0.16.4	cpe:2.3:a:saltstack:salt:0.16.4:::::::*
saltstack	salt	0.17.0	cpe:2.3:a:saltstack:salt:0.17.0:::::::*