CVE-2022-22936

Description

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access on minion under certain scenarios.

Risk Information

Base Score

8.8

MODERATE

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.108

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2022-22934,CVE-2022-22935,CVE-2022-22936,CVE-2022-22941 are affected in VMware SALT *	Windows
Vulnerabilities CVE-2022-22934,CVE-2022-22935,CVE-2022-22936,CVE-2022-22941 are affected in VMware SALT 3002.5	Windows
Vulnerabilities CVE-2022-22934,CVE-2022-22935,CVE-2022-22936,CVE-2022-22941 are fixed in Python-salt 3002.8	Windows
Vulnerabilities CVE-2022-22934,CVE-2022-22935,CVE-2022-22936,CVE-2022-22941 are fixed in Python-salt 3003.4	Windows
Vulnerabilities CVE-2022-22934,CVE-2022-22935,CVE-2022-22936,CVE-2022-22941 are fixed in Python-salt 3004.1	Windows
Vulnerabilities CVE-2022-22934,CVE-2022-22935,CVE-2022-22936,CVE-2022-22941 are fixed in Python-salt for linux 3002.8	Linux
Vulnerabilities CVE-2022-22934,CVE-2022-22935,CVE-2022-22936,CVE-2022-22941 are fixed in Python-salt for linux 3003.4	Linux
Vulnerabilities CVE-2022-22934,CVE-2022-22935,CVE-2022-22936,CVE-2022-22941 are fixed in Python-salt for linux 3004.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234