Password Information Exposure in SaltStack by Salt Software
CVE-2015-6941

9.8CRITICAL

Key Information:

Vendor

Saltstack

Status
Salt 2015
Vendor
CVE Published:
9 August 2017

What is CVE-2015-6941?

The SaltStack software in versions 2015.5.x prior to 2015.5.6 and 2015.8.x prior to 2015.8.1 contains a vulnerability where sensitive password information is unintentionally exposed in debug logs during operations such as user creation. This can lead to potential unauthorized access if the logs are not adequately secured, as attackers gaining access to these logs could retrieve sensitive credentials.

References

https://docs.saltstack.com/en/latest/topics/releases/2015...
x_refsource_CONFIRM
https://docs.saltstack.com/en/latest/topics/releases/2015...
x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1273066
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.