Home

CVE-2017-14695

Description

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.

Risk Information

Base Score
9.8
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.331

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2017-12791,CVE-2017-14695,CVE-2017-14696 are affected in VMware SALT 2016.11.6Windows
Vulnerabilities CVE-2017-12791,CVE-2017-14695,CVE-2017-14696 are affected in VMware SALT 2017.7.0Windows
Vulnerabilities CVE-2017-14695,CVE-2017-14696,CVE-2017-8109 are affected in VMware SALT 2016.11Windows
Multiple Vulnerabilities are affected in VMware SALT 2016.11.0Windows
Multiple Vulnerabilities are affected in VMware SALT 2016.11.1Windows
Vulnerabilities CVE-2017-14695,CVE-2017-14696 are affected in VMware SALT 2016.11.1-rc1Windows
Vulnerabilities CVE-2017-14695,CVE-2017-14696 are affected in VMware SALT 2016.11.1-rc2Windows
Multiple Vulnerabilities are affected in VMware SALT 2016.11.2Windows
Vulnerabilities CVE-2017-14695,CVE-2017-14696,CVE-2017-8109 are affected in VMware SALT 2016.11.3Windows
Multiple Vulnerabilities are affected in VMware SALT 2016.11.4Windows
Multiple Vulnerabilities are affected in VMware SALT 2016.11.5Windows
Vulnerabilities CVE-2017-14695,CVE-2017-14696 are affected in VMware SALT 2016.11.7Windows
Multiple Vulnerabilities are affected in VMware SALT 2016.3.7Windows
Vulnerabilities CVE-2017-14695,CVE-2017-14696 are affected in VMware SALT 2017.7.1Windows
Vulnerabilities CVE-2017-14695,CVE-2017-14696 are fixed in Python-salt 2016.11.8Windows
Multiple vulnerabilities are fixed in Python-salt 2016.3.8Windows
Vulnerabilities CVE-2017-14695,CVE-2017-14696 are fixed in Python-salt 2017.7.2Windows
Vulnerabilities CVE-2017-14695,CVE-2017-14696 are fixed in Python-salt for linux 2016.11.8Linux
Multiple vulnerabilities are fixed in Python-salt for linux 2016.3.8Linux
Vulnerabilities CVE-2017-14695,CVE-2017-14696 are fixed in Python-salt for linux 2017.7.2Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234