CVE-2018-15751
salt-api: SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execu...
CVE-2018-15751 is fixed in 8 products on 1 platform, first by salt-api 2017.7.4+dfsg1-1ubuntu18.04.2, released April 30, 2020. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0490
92nd percentile
SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| salt-api · Ubuntu 18.04.6 LTS (bionic) | 2017.7.4+dfsg1-1ubuntu18.04.2 | salt-api 2017.7.4+dfsg1-1ubuntu18.04.2 | Apr 30, 2020 |
| salt-cloud · Ubuntu 18.04.6 LTS (bionic) | 2017.7.4+dfsg1-1ubuntu18.04.2 | salt-cloud 2017.7.4+dfsg1-1ubuntu18.04.2 | Apr 30, 2020 |
| salt-common · Ubuntu 18.04.6 LTS (bionic) | 2017.7.4+dfsg1-1ubuntu18.04.2 | salt-common 2017.7.4+dfsg1-1ubuntu18.04.2 | Apr 30, 2020 |
| salt-master · Ubuntu 18.04.6 LTS (bionic) | 2017.7.4+dfsg1-1ubuntu18.04.2 | salt-master 2017.7.4+dfsg1-1ubuntu18.04.2 | Apr 30, 2020 |
| salt-minion · Ubuntu 18.04.6 LTS (bionic) | 2017.7.4+dfsg1-1ubuntu18.04.2 | salt-minion 2017.7.4+dfsg1-1ubuntu18.04.2 | Apr 30, 2020 |
| salt-proxy · Ubuntu 18.04.6 LTS (bionic) | 2017.7.4+dfsg1-1ubuntu18.04.2 | salt-proxy 2017.7.4+dfsg1-1ubuntu18.04.2 | Apr 30, 2020 |
| salt-ssh · Ubuntu 18.04.6 LTS (bionic) | 2017.7.4+dfsg1-1ubuntu18.04.2 | salt-ssh 2017.7.4+dfsg1-1ubuntu18.04.2 | Apr 30, 2020 |
| salt-syndic · Ubuntu 18.04.6 LTS (bionic) | 2017.7.4+dfsg1-1ubuntu18.04.2 | salt-syndic 2017.7.4+dfsg1-1ubuntu18.04.2 | Apr 30, 2020 |