Detections
Analytics

CVE-2021-3144

critical

Description

In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)

References

https://www.debian.org/security/2021/dsa-5011

https://security.gentoo.org/glsa/202310-22

https://security.gentoo.org/glsa/202103-01

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YOGNT2XWPOYV7YT75DN7PS4GIYWFKOK5/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUGLOJ6NXLCIFRD2JTXBYQEMAEF2B6XH/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GRVZ5WAEI3XFN2BDTL6DDXFS5HYSDVB/

https://lists.debian.org/debian-lts-announce/2021/11/msg00009.html

https://github.com/saltstack/salt/releases

https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/

Details

Source: Mitre, NVD

Published: 2021-02-27

Updated: 2024-11-21

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Critical

EPSS

EPSS: 0.06372