CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 7.5
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: saltstack salt 2018.3, 2019.2 is affected by: sql injection. the impact is: an attacker could escalate privileges on mysql server deployed by cloud provider. it leads to rce. the component is: the mysql.user_chpass function from the mysql module for salt. the attack vector is: specially crafted password string. the fixed version is: 2018.3.4.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-07-18
Last Modified Date: 2019-08-13