Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2025-22239

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

VectorLOCAL

PublishedJun 13, 2025, 07:15

Published Bysecurity@vmware.com

Base Score

Score8.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

salt(PyPI)3006.0rc13006.12N/A

salt(PyPI)3007.0rc13007.4N/A

References

https://docs.saltproject.io/en/3006/topics/releases/3006.12.html
https://docs.saltproject.io/en/3007/topics/releases/3007.4.html

Weakness Type

CWE-285

CVSS Metrics

Base Score

8.1

Vector String

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

Base SeverityHigh

Version

3.1

Attack Vector (AV)

LOCAL