CVE-2021-3148 vulnerability in SaltStack and Other Products
Published on February 27, 2021
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
Products Associated with CVE-2021-3148
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-3148 are published in these products:
Exploit Probability
EPSS
12.14%
Percentile
93.71%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.