VULNERABILITY INTELLIGENCE
CVE-2020-16846
CVSS score9.8 CRITICAL
EPSS probability99.59%
CISA KEVKnown exploited vulnerability
Published2020-11-06
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Known Exploited Vulnerability
SaltStack Salt Shell Injection Vulnerability
Vendor / product: SaltStack / Salt
Description
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
Weakness classification
- nvd@nist.gov: CWE-78
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-78
Primary references
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
- cve@mitre.org — Release Notes
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org — Release Notes
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org — Broken Link, Vendor Advisory
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Third Party Advisory, VDB Entry