{"id":"CVE-2020-28243","published":"2021-02-27T00:00:00Z","modified":"2024-08-04T16:33:58Z","title":"An issue was discovered in SaltStack Salt before 3002.5","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04302,"percentile":0.9111,"provenance":"source"},"cwes":[],"references":[{"url":"https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/","tags":[]},{"url":"https://github.com/stealthcopter/CVE-2020-28243","tags":[]},{"url":"https://sec.stealthcopter.com/cve-2020-28243/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/","tags":["vendor-advisory"]},{"url":"https://security.gentoo.org/glsa/202103-01","tags":["vendor-advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html","tags":["mailing-list"]},{"url":"https://www.debian.org/security/2021/dsa-5011","tags":["vendor-advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html","tags":["mailing-list"]},{"url":"https://security.gentoo.org/glsa/202310-22","tags":["vendor-advisory"]}],"priority":{"score":23.2,"factors":[{"name":"EPSS percentile","points":18.22},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2020-12-22","earliestUrl":"https://github.com/stealthcopter/CVE-2020-28243","repos":[{"name":"stealthcopter/CVE-2020-28243","url":"https://github.com/stealthcopter/CVE-2020-28243","stars":20,"created":"2020-12-22"}]},"first":{"date":"2020-12-22","source":"PoC-in-GitHub","url":"https://github.com/stealthcopter/CVE-2020-28243"},"provenance":"source"},"affected":[{"ecosystem":"PyPI","package":"salt","vulnerableRanges":["<2015.8.13",">=2016.3.0, <2016.11.5",">=2016.11.7, <2016.11.10",">=2017.5.0, <2017.7.8",">=2018.2.0, <=2018.3.5",">=2019.2.0, <2019.2.8",">=3000, <3000.7",">=3001, <3001.5",">=3002, <3002.3","<2015.8.10"],"patched":["2015.8.13","2016.11.5","2016.11.10","2017.7.8","2019.2.8","3000.7","3001.5","3002.3","2015.8.10","2016.3.4"],"from":["GHSA-phhw-3wc9-8q75","PYSEC-2021-73"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0235","exploited":false,"provenance":"source"}}