← Back

CVE-2021-3144

nvd nist
Published: Feb 27, 2021Modified: Jun 17, 2026

JSON object

Loading...
9.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploitability: 3.9 / Impact: 5.2
Source: NVD

Description

In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)

Affected (21)

Saltstack
1 product
Salt
Fedoraproject
1 product
Fedora
Debian
1 product
Debian Linux
Configuration A
15 vulnerable
Vulnerable SoftwareAffected Versions
Saltstack
Salt
version < 2015.8.10
Salt
2015.8.11 ≤ version < 2015.8.13
Salt
2016.11.4 ≤ version < 2016.11.5
Salt
2016.11.7 ≤ version < 2016.11.10
Salt
2016.3.0 ≤ version < 2016.3.4
Salt
2016.3.5 ≤ version < 2016.3.6
Salt
2016.3.7 ≤ version < 2016.3.8
Salt
2016.3.9 ≤ version < 2016.11.3
Salt
2017.5.0 ≤ version < 2017.7.8
Salt
2018.2.0 ≤ version ≤ 2018.3.5
Salt
2019.2.0 ≤ version < 2019.2.5
Salt
2019.2.6 ≤ version < 2019.2.8
Salt
3000 ≤ version < 3000.6
Salt
3001 ≤ version < 3001.4
Salt
3002 ≤ version < 3002.5
Configuration B
3 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Fedora
Version 32
Fedora
Version 33
Fedora
Version 34
Configuration C
3 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 10.0
Debian Linux
Version 11.0
Debian Linux
Version 9.0

Related CWEs

CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (18)

Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.