CVE-2020-16846
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in...
Basic Information
- CVE State
- PUBLISHED
- Reserved Date
- August 04, 2020
- Published Date
- November 06, 2020
- Last Updated
- February 07, 2025
- Vendor
- n/a
- Product
- n/a
- Description
- An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
CVSS Scores
SSVC Information
- Exploitation
- active
- Automatable
- Yes
- Technical Impact
- total
Exploit Status
- Exploited in the Wild
- Yes (added 2021-11-03 00:00:00 UTC) Source
References
https://github.com/saltstack/salt/releases
https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html
https://security.gentoo.org/glsa/202011-13
http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html
https://www.zerodayinitiative.com/advisories/ZDI-20-1381/
https://www.zerodayinitiative.com/advisories/ZDI-20-1383/
https://www.zerodayinitiative.com/advisories/ZDI-20-1380/
https://www.zerodayinitiative.com/advisories/ZDI-20-1379/
https://www.zerodayinitiative.com/advisories/ZDI-20-1382/
https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html
https://www.debian.org/security/2021/dsa-4837
https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
Known Exploited Vulnerability Information
| Source | Added Date |
|---|---|
| CISA | 2021-11-03 00:00:00 UTC |
Scanner Integrations
| Scanner | URL | Date Detected |
|---|---|---|
| Metasploit | https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/saltstack_salt_api_cmd_exec.rb | 2025-04-29 11:01:15 UTC |
| Nuclei | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-16846.yaml | 2025-04-26 00:00:00 UTC |