漏洞描述
SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
saltproject.iohttps://saltproject.io/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/↗mp.weixin.qq.comhttps://mp.weixin.qq.com/s/R8qw_lWizGyeJS0jOcYXag↗github.comhttps://github.com/vulhub/vulhub/tree/master/saltstack/CVE-2020-16846↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2020-16846↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html↗