CVE-2018-15750

Published: 24 October 2018

Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.

Priority

Cvss 3 Severity Score

5.3

Score breakdown

Status

Package	Release	Status
salt Launchpad, Ubuntu, Debian	bionic	Released (2017.7.4+dfsg1-1ubuntu18.04.2)
	cosmic	Ignored (end of life)
	disco	Released (2018.3.4~git20180207+dfsg1-1)
	eoan	Released (2018.3.4~git20180207+dfsg1-1)
	focal	Does not exist
	hirsute	Ignored (end of life)
	impish	Ignored (end of life)
	jammy	Not vulnerable
	trusty	Not vulnerable
	upstream	Released (2018.3.3+dfsg1-1)
	xenial	Released (2015.8.8+ds-1ubuntu0.1+esm1) Available with Ubuntu Pro

Severity score breakdown

Parameter	Value
Base score	5.3
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	None
Availability impact	None
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›