CVE-2020-11652 KEVPublic exploit Medium · 6.5 EPSS 86.2%

SaltStack Salt Path Traversal Vulnerability

Summary

A path traversal flaw exists in the ClearFuncs class of the salt-master process in SaltStack Salt, where some methods fail to properly sanitise paths. An attacker with valid authentication who can reach the salt-master over the network can use these methods to access arbitrary directories.

Official description · NVD

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

Breakdown

67.5 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

What can follow
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationSource dataMedium confidence149 general detection rules
- Read files and data on the systemT1005 · Data from Local SystemSource dataMedium confidence14 general detection rules

First seen exploited 3 months after disclosure. Public exploit code (Metasploit) was available the same day.

DisclosedPublic exploit codeMetasploit30 Apr 2020day 0
First seen exploitedVulnCheck KEV evidence22 Jul 2020+3 mo
Added to CISA KEVEU database agrees3 Nov 2021+18 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

7 fixes in salt over 16 months. The latest fix listed for salt is 3002.1.

Fixes in saltPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

2018.3.4CVE-2019-101025918 Jul 2019
2019.2.3CVE-2019-1736117 Jan 2020
3000.2CVE-2020-1165130 Apr 2020KEV
3000.2CVE-2020-1165230 Apr 2020KEV
3002.1CVE-2020-168466 Nov 2020KEV
3002.1CVE-2020-174906 Nov 2020
3002.1CVE-2020-255926 Nov 2020Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

MITRE CTID mapping of the CVE · uncategorised

CollectionTA0009

Data from Local System T1005 Medium

MITRE CTID mapping of the CVE · uncategorised

Detection

0 rules for this CVE · 163 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-11652 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Data from Local SystemT100514 general rules

OpenCanary - SMB File Open Requesthightest
Potential Conti Ransomware Database Dumping Activity Via SQLCmdhightest
SQLite Chromium Profile Data DB Accesshightest
SQLite Firefox Profile Data DB Accesshightest
VeeamBackup Database Credentials Dump Via Sqlcmd.EXEhightest
Script Interpreter Spawning Credential Scanner - Linuxhighexperimental
Script Interpreter Spawning Credential Scanner - Windowshighexperimental
Shai-Hulud NPM Package Malicious Exfiltration via Curlhighexperimental

All 14 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: salt.

PyPIsaltGHSA-vp49-2g4r-m3x3 PYSEC-2020-103

Upgrade to 3000.7 or later

Fixes this CVE and 6 other known vulnerabilities in this package (CVE-2020-11651, CVE-2020-16846, +4).

pippip install "salt>=3000.7"

First fixed in 3000.2 for CVE-2020-11652.

Affected versions, by release line

If you run	Upgrade to
3000 up to 3000.2	3000.7first fix for this CVE: 3000.2
All versions before 2019.2.4	2019.2.8first fix for this CVE: 2019.2.4

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

13 links, grouped by NVD tag (12 duplicates merged)

Show 3 moreShow fewer

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG usn.ubuntu.com/4459-1/debian.org/security/2020/dsa-4676

Exploitation evidence

Exploited in the wild

Listed since 3 Nov 2021. Federal due date 3 May 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 3 Nov 2021. EUVD-2020-0172

Saltstack 3000.1 - Remote Code ExecutionEDB-48421 · remote · multiple · 2020-05-05

, 30 Oct 2026

86.2%Top 0.27%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.73%).

3.1

6.5Medium · 6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 2292 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9973 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 NVD exploit link; 3 PoC-in-GitHub repos; 2 Metasploit modules 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 6.5 4.5/7

End-of-life productsupported or unknown 0.0

Total67.5

Record

Published: 30 Apr 2020
Modified: 17 Jun 2026
: CWE-22 Improper Limitation of a Pathname to a Restricted Directory
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.