CVE-2013-4435

Published: Nov 5, 2013Modified: Apr 29, 2026

6.0

Vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability: 6.8 / Impact: 6.4

Source: NVD

Description

Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.

Affected (7)

Products: Saltstack: Salt

Saltstack

1 product

Salt

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Saltstack Salt	Version 0.15.0
Saltstack Salt	Version 0.15.1
Saltstack Salt	Version 0.16.0
Saltstack Salt	Version 0.16.2
Saltstack Salt	Version 0.16.3
Saltstack Salt	Version 0.16.4
Saltstack Salt	Version 0.17.0

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

http://docs.saltstack.com/topics/releases/0.17.1.html

Source: secalert@redhat.com

PatchVendor Advisory

http://www.openwall.com/lists/oss-security/2013/10/18/3

Source: secalert@redhat.com

http://docs.saltstack.com/topics/releases/0.17.1.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.openwall.com/lists/oss-security/2013/10/18/3

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.