← Back

CVE-2017-14695

nvd nist
Published: Oct 24, 2017Modified: May 13, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.

Affected (15)

Products: Saltstack: Salt
Saltstack
1 product
Salt
Configuration A
15 vulnerable
Vulnerable SoftwareAffected Versions
Saltstack
Salt
Up to 2016.3.7
Salt
Version 2016.11.0
Salt
Version 2016.11.1
Salt
Version 2016.11.1 rc1
Salt
Version 2016.11.1 rc2
Salt
Version 2016.11.2
Salt
Version 2016.11.3
Salt
Version 2016.11.4
Salt
Version 2016.11.5
Salt
Version 2016.11.6
Salt
Version 2016.11.7
Salt
Version 2016.11
Salt
Version 2017.7.0
Salt
Version 2017.7.0 rc1
Salt
Version 2017.7.1

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (14)

Source: cve@mitre.org
Issue TrackingRelease NotesThird Party Advisory
Source: cve@mitre.org
Issue TrackingRelease NotesThird Party Advisory
Source: cve@mitre.org
Issue TrackingRelease NotesThird Party Advisory
Source: cve@mitre.org
Issue TrackingRelease NotesVendor Advisory
Source: cve@mitre.org
Issue TrackingRelease NotesVendor Advisory
Source: cve@mitre.org
Issue TrackingRelease NotesVendor Advisory
Source: cve@mitre.org
Issue TrackingPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingRelease NotesThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingRelease NotesThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingRelease NotesThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingRelease NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingRelease NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingRelease NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatchThird Party Advisory

Timeline

No history available yet.