Skip to content
Fencer Vulns
medium 6.5

CVE-2020-11652 kev in the critical feed json

SaltStack Salt is vulnerable Arbitrary Directory Access

published 2020-04-30 6 y ago modified 2026-06-17 4 mo ago also GHSA-vp49-2g4r-m3x3 , PYSEC-2020-103 , EUVD-2020-0172

cvss
6.5
version 3.1, CNA
cisa kev
Exploited
added 2021-11-03
epss
86.4%
EPSS 86.4% chance of exploitation in 30 days, percentile 99.7%
public exploits
3
Metasploit, Exploit-DB

Summary

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • pypi salt 2019.2.4, 3000.2
  • saltstack salt 2019.2.4, 3000.2
  • salt Ubuntu 16.04 LTS 2015.8.8+ds-1ubuntu0.1
  • salt Ubuntu 18.04 LTS 2017.7.4+dfsg1-1ubuntu18.04.2
  • salt Ubuntu Pro 14.04 LTS 0.17.5+ds-1ubuntu0.1~esm2

ubuntu advisories UBUNTU-CVE-2020-11652

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • salt SLES 15 SP1-BCL, SLE Module for Transactional Server 15 SP2, SLE Module for Server Applications 15 SP2 +10 more 3002.2-37.1
  • python-distro SLE Module for Python 2 15 SP3, SLE Module for Python 2 15 SP2, SLE Module for Basesystem 15 SP3 +2 more 1.5.0-3.5.1
  • salt SLE Module for Server Applications 15 SP1, SLE Module for Python 2 15 SP1, SLE Module for Basesystem 15 SP1 3000-6.37.1
  • salt SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 3000-5.78.1
  • salt SLE Point of Sale 12 SP2, SLE Module for Advanced Systems Management 12, Manager Server 3.2 +2 more 3000-46.101.1
  • python-singledispatch SLE Point of Sale 12 SP2, SLE Module for Advanced Systems Management 12, Manager Server 3.2 +2 more 3.4.0.3-1.5.1
  • salt Enterprise Storage 5 2016.11.4-48.10.1
  • salt SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 2019.2.0-5.67.1

suse advisories SUSE-SU-2021:2106-1SUSE-SU-2021:2105-1SUSE-SU-2020:1974-1SUSE-SU-2020:1973-1SUSE-SU-2020:1971-1SUSE-SU-2020:1392-1

  • python-distro openSUSE Leap 15.3 1.5.0-3.5.1
  • salt openSUSE Leap 15.2 3002.2-lp152.3.36.1
  • salt openSUSE Leap 15.1 3000-lp151.5.21.1
  • salt openSUSE Leap 15.1 2019.2.0-lp151.5.15.1

opensuse advisories openSUSE-SU-2021:2106-1openSUSE-SU-2021:0899-1openSUSE-SU-2020:1074-1openSUSE-SU-2020:0564-1

  • salt Alpine 3.11, Alpine 3.10 2019.2.4-r0
  • salt Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 3000.2-r0

alpine advisories ALPINE-CVE-2020-11652

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-11652 updated cvss 6.5

salt: salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths

  • Red Hat Ceph Storage 2 salt, salt-minion
    affected: workaround, no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit auxiliary/gather/saltstack_salt_root_key)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
5 y ago
Patch by
2022-05-03 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
SaltStack, Salt
CISA name
SaltStack Salt Path Traversal Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

86.45% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:H

Affected packages

ecosystem package affected fixed in
pypi salt
<2019.2.4
>=3000, <3000.2
2019.2.4
3000.2

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.