CVE-2022-22941

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1

High · published March 29, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
71.1
In the wild
Unconfirmed
What it is

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01340 · 71.1th percentile
Published
2022-03-29T00:00Z
EPSS history
Timeline
  • 29 MAR 00:00Z
    An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1
    cvelistv5