Base Score

MEDIUM5.3

CVE-2015-1838

modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

VectorLOCAL

Published Bysecalert@redhat.com

Published DateApr 13, 2017, 14:59

Affected Versions(1)

salt(PyPI)

Introduced0

Fixed2014.7.4

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
salt(PyPI)	0	2014.7.4	N/A

Weakness Type (CWE):CWE-19

CVSS Metrics

Base Score

5.3

Vector String

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Base Severity

MEDIUM

Version

3.0

Attack Vector (AV)

LOCAL

Attack Complexity (AC)

LOW

Privileges Required (PR)

LOW

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

LOW

Integrity (I)

LOW

Availability (A)

LOW

References

http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html
https://bugzilla.redhat.com/show_bug.cgi?id=1212784
https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html
https://github.com/saltstack/salt/commit/e11298d7155e9982749483ca5538e46090caef9c

Base Score

MEDIUM5.3

Weakness Type (CWE):CWE-19

CVSS Metrics

Base Score

5.3

Vector String

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Base Severity

MEDIUM

Version

3.0

Attack Vector (AV)

LOCAL

Attack Complexity (AC)

LOW

Privileges Required (PR)

LOW

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

LOW

Integrity (I)

LOW

Availability (A)

LOW