« Volver al listado

CVE-2022-22934

Estado: ModificadaAlta (8.8)—

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Saltstack — Salt

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-22934",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.5,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "SaltStack Salt",
          "versions": [
            {
              "status": "affected",
              "version": "SaltStack Salt prior to 3002.8, 3003.4, 3004.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-03-29T17:15:15.170",
  "references": [
    {
      "url": "https://github.com/saltstack/salt/releases%2C",
      "tags": [
        "Broken Link"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://repo.saltproject.io/",
      "tags": [
        "Product"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://saltproject.io/security_announcements/salt-security-advisory-release/%2C",
      "tags": [
        "Broken Link"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://security.gentoo.org/glsa/202310-22",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://github.com/saltstack/salt/releases%2C",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://repo.saltproject.io/",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://saltproject.io/security_announcements/salt-security-advisory-release/%2C",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/202310-22",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data."
    },
    {
      "lang": "es",
      "value": "Se ha detectado un problema en SaltStack Salt en versiones anteriores a 3002.8, 3003.4, 3004.1. Los maestros de Salt no firman los datos del pilar con la clave pública del minion, lo que puede resultar en que los atacantes sustituyan datos arbitrarios del pilar"
    }
  ],
  "lastModified": "2026-06-17T04:29:12.143",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7449317-8304-4045-AF72-CF78F207D879",
              "versionEndExcluding": "3002.8",
              "versionStartIncluding": "3002"
            },
            {
              "criteria": "cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "318996F4-15C8-4721-BC68-ED3CE42ED5B3",
              "versionEndExcluding": "3003.4",
              "versionStartIncluding": "3003"
            },
            {
              "criteria": "cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "174C223F-0F76-4725-BA07-E9DE35E4E8AE",
              "versionEndExcluding": "3004.1",
              "versionStartIncluding": "3004"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}