Cyber Resilience

CVE-2023-20898

Saltstack Salt ≤ 3005.2

Published
05 September 2023
Modified
13 February 2025
Patch / advisory
View advisory
CVSS Score v3.1 4.2
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS Score 0.0029 21th percentile
Risk Priority 33 floored blend · peak EPSS

Summary

CVE-2023-20898 is a medium-severity an unspecified weakness vulnerability in Saltstack Salt. Its CVSS base score is 4.2 (Medium).

Operationally, ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong…

more

data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.

CWE(s)
NVD-CWE-noinfo

Related Threats

CVEs Like This One

CVE-2023-20897Same product: Saltstack Salt
CVE-2024-38824Same product: Saltstack Salt
CVE-2020-25592Same product: Saltstack Salt
CVE-2021-3197Same product: Saltstack Salt
CVE-2021-25282Same product: Saltstack Salt
CVE-2021-25281Same product: Saltstack Salt
CVE-2020-16846Same product: Saltstack Salt
CVE-2020-11651Same product: Saltstack Salt
CVE-2020-11652Same product: Saltstack Salt

Affected Assets

saltstack
salt
≤ 3005.2 · 3006.0 — 3006.2

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References