GHSA-vp49-2g4r-m3x3
MEDIUMSaltStack Salt is vulnerable Arbitrary Directory Access
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Blast Radius
salt🐍saltReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | salt | all versions | 2019.2.4 |
| 🐍PyPI | salt | ≥ 3000&&< 3000.2 | 3000.2 |
Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Saltstack 3000.1 - Remote Code Execution
by Jasper Lievisse Adriaanse · May 5, 2020
Frequently Asked Questions
Is GHSA-vp49-2g4r-m3x3 in your stack?
O3 detects GHSA-vp49-2g4r-m3x3 across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.