What’s Vulnerable › Vulnerabilities

CVE-2024-22232: Specially crafted url can be created which leads to a directory traversal in the salt file server

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-27 · updated 2026-06-17
• Weakness: CWE-22

Description

A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem.

Affected products

• VMware Salt Project: before 3005.5, 3006.6 — fixed in 3006.6, 3005.5

How to fix

Upgrade to a fixed version: VMware Salt Project 3006.6, 3005.5. Check the vendor advisory for mitigations.

References

• https://saltproject.io/security-announcements/2024-01-31-advisory/
• https://saltproject.io/security-announcements/2024-01-31-advisory/

Get alerted when CVE-2024-22232 or the next vulnerability affects your stack