CVE-2020-11651

Description from NVD

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

NVD References

Description from Forti

SaltStack ClearFuncs Handling Authentication Bypass

This indicates an attack attempt to exploit an Authentication Bypass vulnerability in SaltStack Salt.The vulnerability is due to unintentionally exposed methods that allows an attacker to bypass authentication and disclose sensitive information and further perform code execution on the vulnerable system.

Affected Products

SaltStack Salt before 2019.2.4 and 3000 before 3000.2

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Applied latest upgrade or patch from the vendor:
https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html

References

Refer to Information on External Sites

Software Tag: SaltStack(1 tweets)