Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a     directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the     cache directory. (CVE-2025-22238)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02534-1 advisory.

    - Security issues fixed:

      - CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
      - CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport     (bsc#1244564)
      - CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
      - CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
      - CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
      - CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
      - CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
      - CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
      - CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack     (bsc#1244572)
      - CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
      - CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
      - CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

    - Other bugs fixed:

      - Added subsystem filter to udev.exportdb (bsc#1236621)
      - Fixed Ubuntu 24.04 test failures
      - Fixed refresh of osrelease and related grains on Python 3.10+
      - Fixed issue requiring proper Python flavor for dependencies

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02502-1 advisory.

    - Security issues fixed:

      - CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
      - CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport     (bsc#1244564)
      - CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
      - CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
      - CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
      - CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
      - CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
      - CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
      - CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack     (bsc#1244572)
      - CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
      - CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
      - CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

    - Other bugs fixed:

      - Added subsystem filter to udev.exportdb (bsc#1236621)
      - Fixed Ubuntu 24.04 test failures
      - Fixed refresh of osrelease and related grains on Python 3.10+
      - Fixed issue requiring proper Python flavor for dependencies

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02476-1 advisory.

    release-notes-susemanager-proxy:

    - Update to SUSE Manager 4.3.16
      * CVE Fixed         CVE-2025-23392, CVE-2025-23393, CVE-2025-46809
      * Bugs mentioned:
        bsc#1236601, bsc#1236635, bsc#1236779, bsc#1237294, bsc#1238922         bsc#1239826, bsc#1240386, bsc#1242004, bsc#1243460, bsc#1245222         bsc#1245005

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02500-1 advisory.

    - Security issues fixed:

      - CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
      - CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport     (bsc#1244564)
      - CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
      - CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
      - CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
      - CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
      - CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
      - CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
      - CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack     (bsc#1244572)
      - CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
      - CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
      - CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

    - Other bugs fixed:

      - Added subsystem filter to udev.exportdb (bsc#1236621)
      - Fixed Ubuntu 24.04 test failures
      - Fixed refresh of osrelease and related grains on Python 3.10+
      - Fixed issue requiring proper Python flavor for dependencies

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02492-1 advisory.

    venv-salt-minion:

    - Security issues fixed:

      - CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
      - CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport     (bsc#1244564)
      - CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
      - CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
      - CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
      - CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
      - CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
      - CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
      - CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack     (bsc#1244572)
      - CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
      - CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
      - CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

    - Other bugs fixed:

      - Added subsystem filter to udev.exportdb (bsc#1236621)
      - Fixed Ubuntu 24.04 test failures
      - Fixed refresh of osrelease and related grains on Python 3.10+
      - Fixed issue requiring proper Python flavor for dependencies
      - Fixed VIRTUAL_ENV variable in activate file to point to actual path
      - Fixed the bundle path in pyvenv.cfg
      - Prevent tests failures when pygit2 is not present

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02501-1 advisory.

    - Security issues fixed:

      - CVE-2024-38822: Fixed Minion token validation (bsc#1244561)
      - CVE-2024-38823: Fixed server vulnerability to replay attacks when not using a TLS encrypted transport     (bsc#1244564)
      - CVE-2024-38824: Fixed directory traversal vulnerability in recv_file method (bsc#1244565)
      - CVE-2024-38825: Fixed salt.auth.pki module authentication issue (bsc#1244566)
      - CVE-2025-22240: Fixed arbitrary directory creation or file deletion with GitFS (bsc#1244567)
      - CVE-2025-22236: Fixed Minion event bus authorization bypass (bsc#1244568)
      - CVE-2025-22241: Fixed the use of un-validated input in the VirtKey class (bsc#1244570)
      - CVE-2025-22237: Fixed exploitation of the 'on demand' pillar functionality (bsc#1244571)
      - CVE-2025-22238: Fixed the master's default cache vulnerability to a directory traversal attack     (bsc#1244572)
      - CVE-2025-22239: Fixed the arbitrary event injection on the Salt Master (bsc#1244574)
      - CVE-2025-22242: Fixed a Denial of Service vulnerability through file read operation (bsc#1244575)
      - CVE-2025-47287: Fixed a Denial of Service vulnerability in Tornado logging behavior (bsc#1243268)

    - Other bugs fixed:

      - Added subsystem filter to udev.exportdb (bsc#1236621)
      - Fixed Ubuntu 24.04 test failures
      - Fixed refresh of osrelease and related grains on Python 3.10+
      - Fixed issue requiring proper Python flavor for dependencies

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-c903306aee advisory.

    Contains fixes for regressions introduced during CVE bugfix update (3007.4).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-b712778148 advisory.

    Contains fixes for regressions introduced during CVE bugfix update (3007.4).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a5d73a0399 advisory.

    - Resolves CVE-2024-38824 RHBZ#2372731
    - Resolves CVE-2024-38824 RHBZ#2372733
    - Resolves CVE-2025-22239 RHBZ#2372732
    - Resolves CVE-2025-22239 RHBZ#2372734
    - Resolves CVE-2025-22236 RHBZ#2372774
    - Resolves CVE-2025-22236 RHBZ#2372776
    - Resolves CVE-2025-22242 RHBZ#2372741
    - Resolves CVE-2025-22242 RHBZ#2372745
    - Resolves CVE-2025-22240 RHBZ#2372746
    - Resolves CVE-2025-22241 RHBZ#2372748
    - Resolves CVE-2025-22240 RHBZ#2372752
    - Resolves CVE-2025-22241 RHBZ#2372753


    ----

    - Resolves RHBZ#2366381
    - Resolves CVE-2024-38824 RHBZ#2372731
    - Resolves CVE-2024-38824 RHBZ#2372733
    - Resolves CVE-2025-22239 RHBZ#2372732
    - Resolves CVE-2025-22239 RHBZ#2372734
    - Resolves CVE-2025-22236 RHBZ#2372774
    - Resolves CVE-2025-22236 RHBZ#2372776
    - Resolves CVE-2025-22242 RHBZ#2372741
    - Resolves CVE-2025-22242 RHBZ#2372745
    - Resolves CVE-2025-22240 RHBZ#2372746
    - Resolves CVE-2025-22241 RHBZ#2372748
    - Resolves CVE-2025-22240 RHBZ#2372752
    - Resolves CVE-2025-22241 RHBZ#2372753

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-31a7eefb8f advisory.

    - Resolves CVE-2024-38824 RHBZ#2372731
    - Resolves CVE-2024-38824 RHBZ#2372733
    - Resolves CVE-2025-22239 RHBZ#2372732
    - Resolves CVE-2025-22239 RHBZ#2372734
    - Resolves CVE-2025-22236 RHBZ#2372774
    - Resolves CVE-2025-22236 RHBZ#2372776
    - Resolves CVE-2025-22242 RHBZ#2372741
    - Resolves CVE-2025-22242 RHBZ#2372745
    - Resolves CVE-2025-22240 RHBZ#2372746
    - Resolves CVE-2025-22241 RHBZ#2372748
    - Resolves CVE-2025-22240 RHBZ#2372752
    - Resolves CVE-2025-22241 RHBZ#2372753


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by multiple vulnerabilities, including the following:

  - Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master     cache directory. (CVE-2024-38824)

  - Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which     may be able to execute a job on other minions (>= 3007.0). (CVE-2025-22236)

  - Arbitrary event injection on Salt Master. The master's _minion_event method can be used by and authorized     minion to send arbitrary events onto the master's event bus. (CVE-2025-22239)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a
    directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the
    cache directory. (CVE-2025-22238)

ID	Name	Product	Family	Severity
261177	Linux Distros Unpatched Vulnerability : CVE-2025-22238	Nessus	Misc.	medium
242955	SUSE SLES15: python3-salt / salt / salt-api / salt-bash-completion / salt-cloud / etc (SUSE-SU-2025:02534-1)	Nessus	SuSE Local Security Checks	high
242657	SUSE SLES15: python311-salt / salt / salt-api / salt-bash-completion / salt-doc / etc (SUSE-SU-2025:02502-1)	Nessus	SuSE Local Security Checks	high
242656	SUSE SLES15 : Security update 4.3.16 for Multi-Linux Manager Proxy and Retail Branch Server (SUSE-SU-2025:02476-1)	Nessus	SuSE Local Security Checks	medium
242654	SUSE SLES15: python3-salt / salt / salt-api / salt-bash-completion / salt-cloud / etc (SUSE-SU-2025:02500-1)	Nessus	SuSE Local Security Checks	high
242653	SUSE SLES15 : Security update 5.0.5 for Multi-Linux Manager Salt Bundle (SUSE-SU-2025:02492-1)	Nessus	SuSE Local Security Checks	high
242652	SUSE SLED15: python3-salt / python3-salt-testsuite / salt / salt-api / etc (SUSE-SU-2025:02501-1)	Nessus	SuSE Local Security Checks	high
242076	Fedora 42 : salt (2025-c903306aee)	Nessus	Fedora Local Security Checks	medium
242050	Fedora 41 : salt (2025-b712778148)	Nessus	Fedora Local Security Checks	medium
241074	Fedora 42 : salt (2025-a5d73a0399)	Nessus	Fedora Local Security Checks	critical
240915	Fedora 41 : salt (2025-31a7eefb8f)	Nessus	Fedora Local Security Checks	critical
240180	SaltStack 3000 < 3006.12 / 3007 < 3007.4 Multiple Vulnerabilities	Nessus	Misc.	critical
427871	SCA: security update for salt (GHSA-r546-h3ff-q585)	Tenable Cloud Security	SCA Checks	medium
427871	SCA: security update for salt (GHSA-r546-h3ff-q585)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-22238

medium

Tenable Plugins

medium

high

high

medium

high

high

high

medium

medium

critical

critical

critical

medium

medium