What is GHSA-2qw3-2wv6-p64x?

GHSA-2qw3-2wv6-p64x is a security advisory published by GitHub Security Advisories with High severity. Path traversal in saltstack

Which CVE IDs does GHSA-2qw3-2wv6-p64x cover?

GHSA-2qw3-2wv6-p64x covers the following CVE IDs: CVE-2024-22232. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2qw3-2wv6-p64x?

GHSA-2qw3-2wv6-p64x has a CVSS v3 base score of 7.7, published by GitHub Security Advisories.

Which products are affected by GHSA-2qw3-2wv6-p64x?

GHSA-2qw3-2wv6-p64x affects 2 products, including: pip/salt:\u003c 3005.5; pip/salt:\u003e= 3006.0, \u003c 3006.6.

GHSA-2qw3-2wv6-p64xHighCVSS 7.7

Path traversal in saltstack

Vendor

GitHub Security Advisories

Published

June 27, 2024

Last Modified

June 27, 2024

🔗 CVE IDs covered (1)

CVE-2024-22232 →

📋 Description

A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem.

🎯 Affected products2

pip/salt:< 3005.5
pip/salt:>= 3006.0, < 3006.6

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-22232
https://saltproject.io/security-announcements/2024-01-31-advisory
https://github.com/saltstack/salt/commit/e0cdb80b55123f4a024759ffcf2b3f0e0788e7ab
https://github.com/advisories/GHSA-2qw3-2wv6-p64x