CVE-2022-22941 Information

Description

An issue was discovered in SaltStack Salt in versions before 3002.8 3003.4 3004.1. When configured as a Master-of-Masters with a publisher_acl if a user configured in the publisher_acl targets any minion connected to the Syndic the Salt Master incorrectly interpreted no valid targets as valid allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters allowing users specified in the publisher_acl to bypass permissions publishing authorized commands to any configured minion.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Reference

https://github.com/saltstack/salt/releases https://repo.saltproject.io/ https://saltproject.io/security_announcements/salt-security-advisory-release/

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.8