What’s Vulnerable › Vulnerabilities

CVE-2024-22231: Syndic cache directory creation is vulnerable to a directory traversal attack

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-27 · updated 2026-06-17
• Weakness: CWE-22

Description

Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master.

Affected products

• VMware Salt Project: before 3005.5, 3006.6 — fixed in 3006.6, 3005.5

How to fix

Upgrade to a fixed version: VMware Salt Project 3006.6, 3005.5. Check the vendor advisory for mitigations.

References

• https://saltproject.io/security-announcements/2024-01-31-advisory/
• https://saltproject.io/security-announcements/2024-01-31-advisory/

Get alerted when CVE-2024-22231 or the next vulnerability affects your stack