CVE-2020-11652: SaltStack Salt Path Traversal Vulnerability
Vulnerability summary
CVE-2020-11652 is a medium (CVSS 6.5) Path Traversal vulnerability in SaltStack Salt. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 86.18% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 4 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 18 · Related 15Timeline
- 30-04-2020PublishedVulnerability first disclosed.
- 03-11-2021Added to CISA KEVSaltStack Salt Path Traversal Vulnerability
- 03-05-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
86.18%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 86.18% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-11-2021
- Federal due date
- 03-05-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2020-11652
Public exploits
4 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Saltstack 3000.1 - Remote Code Execution
Maturity: poc
SaltStack Salt Master Server Root Key Disclosure
auxiliary/gather/saltstack_salt_root_key
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Blackberry1 product
- workspaces_server≤ 7.1.3 | ≥ 8.0.0, ≤ 8.2.6 | 9.1.0
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04
Debian1 product
- debian_linuxEOL8.0 | 9.0 | 10.0
Opensuse1 product
- leapEOL15.1
PyPI1 product
- salt< 2019.2.4 | ≥ 3000, < 3000.2
Saltstack1 product
- salt< 2019.2.4 | ≥ 3000, < 3000.2
Ubuntu1 product
- salt< 0.17.5+ds-1ubuntu0.1~esm2 | < 2015.8.8+ds-1ubuntu0.1 | < 2017.7.4+dfsg1-1ubuntu18.04.2
Vmware1 product
- application_remote_collector7.5.0 | 8.0.0
8 vendors · 8 products
References
23 links- github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rstX Refsource MISCWEBREPORTThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-04/msg00047.htmlVendor AdvisoryX Refsource SUSEWEBREPORTMailing ListThird Party Advisory
- packetstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.htmlX Refsource MISCWEBThird Party AdvisoryVDB Entry
www.debian.org/security/2020/dsa-4676Vendor AdvisoryX Refsource DEBIANWEBAdvisoryThird Party Advisory- www.vmware.com/security/advisories/VMSA-2020-0009.htmlX Refsource CONFIRMWEBAdvisoryThird Party Advisory
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AGVendor AdvisoryX Refsource CISCOWEBThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/05/msg00027.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
- support.blackberry.com/kb/articleDetail?articleNumber=000063758X Refsource MISCWEBThird Party Advisory
Show all 23 references
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11652Government ResourceWEBUS Government Resource
- github.com/saltstack/saltPACKAGE