CVE-2017-14695 - CVE House
Back to Database
Status published Critical CVE-2017-14695

Directory traversal vulnerability in minion id validation in SaltStack Salt...

Vulnerability Description

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-14695

Credits & Attribution

No credits recorded in the NVD database.

References

More from saltstack

View All →
CVE-2021-3197
An issue was discovered in SaltStack Salt before 3002.5. The...
Critical 9.8
CVE-2021-3148
An issue was discovered in SaltStack Salt before 3002.5. Sending...
Critical 9.8
CVE-2021-3144
In SaltStack Salt before 3002.5, eauth tokens can be used...
Critical 9.1
CVE-2021-33226
Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker...
Unknown 0
CVE-2021-31607
In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability...
High 7.8

Affected Vendor

Affected Software

salt
Vulnerable Versions:
0, 2016.11, 2016.11.0, 2016.11.1, 2016.11.2, 2016.11.3, 2016.11.4, 2016.11.5, 2016.11.6, 2016.11.7, 2017.7.0, 2017.7.1

Timeline

Official Publish: October 24th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.