CVE-2024-38825

Published: Jun 13, 2025Modified: Jun 17, 2026Deferred

6.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Exploitability: 3.1 / Impact: 2.7

Source: security@vmware.com (Secondary)

Description

The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://docs.saltproject.io/en/3006/topics/releases/3006.12.html

Source: security@vmware.com

https://docs.saltproject.io/en/3007/topics/releases/3007.4.html

Source: security@vmware.com

Timeline

No history available yet.