CVE-2013-4435

Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.

Published Bysecalert@redhat.com

Published DateNov 05, 2013, 18:55

Affected Versions(1)

salt(PyPI)

Introduced0.15.0

Fixed0.17.1

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
salt(PyPI)	0.15.0	0.17.1	N/A

Weakness Type (CWE):CWE-287

CVSS Metrics

Base Score

Vector String

AV:N/AC:M/Au:S/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

http://docs.saltstack.com/topics/releases/0.17.1.html
http://www.openwall.com/lists/oss-security/2013/10/18/3

Weakness Type (CWE):CWE-287

CVSS Metrics

Base Score

Vector String

AV:N/AC:M/Au:S/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL