CVE-2017-14695
CVSS V2 High 7.5
CVSS V3 Critical 9.8
Description
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.
Overview
- CVE ID
- CVE-2017-14695
- Assigner
- cve@mitre.org
- Vulnerability Status
- Analyzed
- Published Version
- 2017-10-24T17:29:00
- Last Modified Date
- 2017-11-14T21:49:19
Weakness Enumerations
CPE Configuration (Product)
CPE | Vulnerable | Operator | Version Start | Version End |
---|---|---|---|---|
cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* | 1 | OR | 2016.3.7 | |
cpe:2.3:a:saltstack:salt:2016.11:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:saltstack:salt:2016.11.0:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:saltstack:salt:2016.11.1:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:saltstack:salt:2016.11.1:rc1:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:saltstack:salt:2016.11.1:rc2:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:saltstack:salt:2016.11.2:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:saltstack:salt:2016.11.3:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:saltstack:salt:2016.11.4:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:saltstack:salt:2016.11.5:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:saltstack:salt:2016.11.6:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:saltstack:salt:2016.11.7:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:saltstack:salt:2017.7.0:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:saltstack:salt:2017.7.0:rc1:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:saltstack:salt:2017.7.1:*:*:*:*:*:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:N/C:P/I:P/A:P
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 7.5
- Severity
- HIGH
- Exploitability Score
- 10
- Impact Score
- 6.4
CVSS Version 3
- Version
- 3.0
- Vector String
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 9.8
- Base Severity
- CRITICAL
- Exploitability Score
- 3.9
- Impact Score
- 5.9
References
Reference URL | Reference Tags |
---|---|
https://github.com/saltstack/salt/commit/80d90307b07b3703428ecbb7c8bb468e28a9ae6d | Issue Tracking Patch Third Party Advisory |
https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html | Issue Tracking Release Notes Vendor Advisory |
https://docs.saltstack.com/en/latest/topics/releases/2016.3.8.html | Issue Tracking Release Notes Vendor Advisory |
https://docs.saltstack.com/en/latest/topics/releases/2016.11.8.html | Issue Tracking Vendor Advisory Release Notes |
https://bugzilla.redhat.com/show_bug.cgi?id=1500748 | Issue Tracking Release Notes Third Party Advisory |
http://lists.opensuse.org/opensuse-updates/2017-10/msg00075.html | Issue Tracking Release Notes Third Party Advisory |
http://lists.opensuse.org/opensuse-updates/2017-10/msg00073.html | Issue Tracking Release Notes Third Party Advisory |
Sources
Source Name | Source URL |
---|---|
NIST | https://nvd.nist.gov/vuln/detail/CVE-2017-14695 |
MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14695 |
History
Created | Old Value | New Value | Data Type | Notes |
---|---|---|---|---|
2022-05-10 08:11:39 | Added to TrackCVE | |||
2022-12-02 22:28:48 | 2017-10-24T17:29Z | 2017-10-24T17:29:00 | CVE Published Date | updated |
2022-12-02 22:28:48 | 2017-11-14T21:49:19 | CVE Modified Date | updated | |
2022-12-02 22:28:48 | Analyzed | Vulnerability Status | updated |