CVE-2025-22239 — Improper Authorization in Vmware Salt

CWE-285 — Improper Authorization5 documents4 sources
Severity
8.1HIGHNVD
EPSS
0.1%
top 65.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Vmware SaltSaltstack Salt
Timeline
PublishedJun 13

Description

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:LExploitability: 1.5 | Impact: 6.0

Affected Packages2 packages

▶CVEListV5vmware/salt3006.x — 3006.12+1
▶PyPIsaltstack/salt3006.0rc1 — 3006.12+1

🔴Vulnerability Details

4
OSV
Salt vulnerable to arbitrary event injection↗2025-06-13
▶
OSV
CVE-2025-22239: Arbitrary event injection on Salt Master↗2025-06-13
▶
GHSA
Salt vulnerable to arbitrary event injection↗2025-06-13
▶
CVEList
CVE-2025-22239 salt advisory↗2025-06-13
▶
CVE-2025-22239 — Improper Authorization in Vmware Salt | cvebase