CVE-2021-3144

CVE Database · CVE-2021-3144

CVE-2021-3144

· CRITICALModified

CVSS v3.1

9.1

EPSS

5.20%

Published

Feb 27, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-613

Affected Products (21)

saltstack · salt (up to 2015.8.10)vulnerable

saltstack · salt (up to 2015.8.13)vulnerable

saltstack · salt (up to 2016.3.4)vulnerable

saltstack · salt (up to 2016.3.6)vulnerable

saltstack · salt (up to 2016.3.8)vulnerable

saltstack · salt (up to 2016.11.3)vulnerable

saltstack · salt (up to 2016.11.5)vulnerable

saltstack · salt (up to 2016.11.10)vulnerable

· salt

References (18)

https://github.com/saltstack/salt/releases

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/

KEV Catalog EPSS Scores Vendors All CVEs