-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure file permissions on the highstate.cache.p file, which is explicitly mentioned in the GitHub issue (#28455). The HighState class's cache handling functions (like cache_highstate()) are responsible for writing this file. The CVE description directly implicates the state.sls functionality, which relies on this caching mechanism. The fix in 2015.8.3 would have addressed the file mode when writing the cache, confirming the function's role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| salt | pip | < 2015.8.3 | 2015.8.3 |