CVE-2017-12791

Critical

Published: 23/08/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

CVE-2017-12791 describes a vulnerability in minion ID validation in SaltStack Salt before version 2016.11.7 and 2017.7.x before 2017.7.1. This allows remote minions with incorrect credentials to authenticate to a master using a crafted minion ID.

Risk Assessment

Organizations may be exposed to unauthorized access to the system, potentially leading to serious security breaches and data loss.

Recommendation

It is recommended to update SaltStack Salt to the latest version to eliminate this vulnerability and implement additional security measures to protect against unauthorized access.

Original NVD description (English source)

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.