Threat Investigation
Request a demo

CVE-2021-25315

Critical

Description

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.

SeverityCritical
CVSS9.8
Exploit probability—
ProductSalt
PublishedMar 3, 2021
First seenMar 3, 2021
Weakness typeCWE-287Improper authentication

How to fix

Update
  • saltstack salt3002.2 or later
  • salt3002.2 or later

Affected products

ProductAffected versionsFixed in
saltstack saltv < 3002.23002.2
saltPyPIv < 3002.23002.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.