{"action":"Upgrade salt to 2016.11.10 or later.","affected":[{"fixed":"2017.7.8","introduced":"2017.7.0"},{"fixed":"2018.3.3","introduced":"2018.3.0"},{"fixed":"2016.11.10","introduced":"2016.11.0"}],"component":"salt","cve_ids":["CVE-2018-15751"],"ecosystem":"PyPI","epss":0.04997,"exploited":false,"fixed_versions":["2017.7.8","2018.3.3","2016.11.10"],"ghsa_id":"GHSA-x549-r7m8-gv63","id":"tcs_01M5KG3GG107DRRKTNGBQ71ZWZ","modified_at":"2024-10-23T18:53:59.858629Z","published_at":"2022-05-13T01:23:13Z","references":["https://osv.dev/vulnerability/GHSA-x549-r7m8-gv63","https://nvd.nist.gov/vuln/detail/CVE-2018-15751","https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html","https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html","https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2018-30.yaml","https://github.com/saltstack/salt","https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/2016.11.10.rst#L13","https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/2017.7.8.rst#L26","https://github.com/saltstack/salt/blob/8f9405cf8e6f7d7776d5000841c886dec6d96250/doc/topics/releases/2018.3.3.rst#L56","https://groups.google.com/d/msg/salt-users/L9xqcJ0UXxs/qgDj42obBQAJ","https://groups.google.com/d/msg/salt-users/dimVF7rpphY/jn3Xv3MbBQAJ","https://lists.debian.org/debian-lts-announce/2020/07/msg00024.html","https://usn.ubuntu.com/4459-1","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-x549-r7m8-gv63","url":"https://osv.dev/vulnerability/GHSA-x549-r7m8-gv63"}],"summary":"SaltStack Salt Remote command execution and incorrect access control when using salt-api"}