CVE-2018-15750: Path Traversal
Directory Traversal vulnerability in salt-api in SaltStack Salt 2016.11.x before 2016.11.10, 2017.7.x before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.
Other sources
Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2016.11.10 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2018.3.3 - Upgrade
Upgrade
pip/saltto a version that resolves this vulnerability.Fixed in 2017.7.8 - Upgrade
Upgrade
alpine/saltto a version that resolves this vulnerability.Fixed in 2018.3.3-r0
Event History
Frequently Asked Questions
What is the CVE ID of this vulnerability?
The CVE ID of this vulnerability is CVE-2018-15750.
What is the severity of CVE-2018-15750?
The severity of CVE-2018-15750 is medium with a CVSS score of 5.3.
What is the affected software?
The affected software is SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3.
How can remote attackers exploit this vulnerability?
Remote attackers can exploit this vulnerability to determine which files exist on the server through directory traversal.
Where can I find more information about CVE-2018-15750?
You can find more information about CVE-2018-15750 at the following references: [link1], [link2], [link3].