01 Record

CVE-2017-8109

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.43% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 37.4% of scored records. A rank, not a probability.
NVD base score: 7.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2017-04-25 17:00Z9 YR AGO

Last updated

2024-08-05 16:27Z2 YR AGO

Reserved

2017-04-25

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-200Exposure of Sensitive Information to an Unauthorized ActorClass
CWE-732Incorrect Permission Assignment for Critical ResourceClass

Data version

5.1

Document digest

3ac4bd110cda54b6e206a54f111b1fd7d536d75c4209db323d45d53383206957

05 Affected products

VendorProductVersionsPlatforms

redhatceph_storageNot specified—

redhatrhsconNot specified—

saltstacksaltNot specified—

06 References

github.comhttps://github.com/saltstack/salt/pull/40609/commits/6e34c2b5e5e849302af7ccd00509929c3809c658x_refsource_CONFIRM
github.comhttps://github.com/saltstack/salt/issues/40075x_refsource_CONFIRM
github.comhttps://github.com/saltstack/salt/pull/40609x_refsource_CONFIRM
bugzilla.suse.comhttps://bugzilla.suse.com/show_bug.cgi?id=1035912x_refsource_CONFIRM
www.securityfocus.com98095http://www.securityfocus.com/bid/98095vdb-entryx_refsource_BID
docs.saltstack.comhttps://docs.saltstack.com/en/latest/topics/releases/2016.11.4.htmlx_refsource_CONFIRM