Salt has insufficient argument validation in several modules
Date: 2022-05
Affected: pip/salt
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2013-4435
CWE: CWE-287
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.


Mitigations:

Architectural layers (MAESTRO):