CVE-2022-22967

CWE-863 — Incorrect Authorization5 documents4 sources
Severity
8.8HIGH
EPSS
0.5%
top 32.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Saltstack Salt
Timeline
PublishedJun 23
Latest updateJun 25

Description

An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDsaltstack/salt3003 — 3003.5+2
▶CVEListV5saltstack_saltSaltStack Salt prior to 3002.9, 3003.5, 3004.2
▶PyPIsalt3003.0 — 3003.5+2

🔴Vulnerability Details

4
OSV
Salt's PAM auth fails to reject locked accounts↗2022-06-25
▶
GHSA
Salt's PAM auth fails to reject locked accounts↗2022-06-25
▶
OSV
CVE-2022-22967: An issue was discovered in SaltStack Salt in versions before 3002↗2022-06-23
▶
CVEList
CVE-2022-22967: An issue was discovered in SaltStack Salt in versions before 3002↗2022-06-22
▶