Descripción
SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/or run commands on salt minions. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.
Acción recomendada
Aplicar las actualizaciones según las instrucciones del fabricante.
Referencias
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2020-11651
Otras vulnerabilidades de SaltStack en el catálogo
- CVE-2020-16846 SaltStack Salt Shell Injection Vulnerability Alta 03-11-2021
- CVE-2020-11652 SaltStack Salt Path Traversal Vulnerability Alta 03-11-2021