CVE-2023-20898: saltstack salt
Vulnerability summary
CVE-2023-20898 is a high (CVSS 7.8) vulnerability in saltstack salt. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 10 · Related 10Timeline
- 05-09-2023PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA4.2MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:NDiffers
- OSV · PypiEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
0.00 pp
From 0.32% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
PyPI1 product
- salt≥ 3006.0rc1, < 3006.2 | < 3005.2
Saltstack1 product
- salt< 3005.2 | ≥ 3006.0, < 3006.2
Ubuntu1 product
- saltAll versions (No fix recorded)
3 vendors · 3 products
References
10 links
- github.com/saltstack/saltPACKAGE