What’s Vulnerable › Vulnerabilities

CVE-2016-3176

• Severity: medium (CVSS 5.6 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-01-31 · updated 2026-06-17
• Weakness: CWE-287

Description

Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.

Affected products

• VMware SALT: through 2015.5.9; 2015.8.0, 2015.8.1, 2015.8.2, 2015.8.3, 2015.8.4, 2015.8.5 (+1)

References

• https://docs.saltstack.com/en/latest/topics/releases/2015.5.10.html
• https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html
• https://docs.saltstack.com/en/latest/topics/releases/2015.5.10.html
• https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html

Get alerted when CVE-2016-3176 or the next vulnerability affects your stack