What’s Vulnerable › Vulnerabilities

CVE-2022-22967

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-23 · updated 2026-06-17
• Weakness: CWE-863

Description

An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.

Affected products

• VMware SALT: before 3002.9; from 3003 before 3003.5; from 3004 before 3004.2 — fixed in 3002.9, 3003.5, 3004.2

How to fix

Upgrade to a fixed version: VMware SALT 3002.9, 3003.5, 3004.2. Check the vendor advisory for mitigations.

References

• https://repo.saltproject.io/
• https://saltproject.io/security_announcements/salt-security-advisory-release-june-21st-2022/%2C
• https://security.gentoo.org/glsa/202310-22
• https://repo.saltproject.io/
• https://saltproject.io/security_announcements/salt-security-advisory-release-june-21st-2022/%2C
• https://security.gentoo.org/glsa/202310-22

Get alerted when CVE-2022-22967 or the next vulnerability affects your stack