Salt Improper Access Control
High severity
GitHub Reviewed
Published
May 14, 2022
to the GitHub Advisory Database
•
Updated Nov 22, 2023
Description
Published by the National Vulnerability Database
Apr 12, 2016
Published to the GitHub Advisory Database
May 14, 2022
Reviewed
Jul 28, 2023
Last updated
Nov 22, 2023
Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.
References