-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability explicitly references salt.modules.cmdmod as the source of cleartext credential logging. The cmdmod module's core functions (run/run_all) handle command execution and parameter logging. Release notes for patched versions (3002.3, 3001.5, etc.) specifically mention fixing credential logging in cmdmod, indicating these functions were improperly logging sensitive arguments. The CWE-312/522 mapping confirms this is a cleartext storage/insufficient credential protection issue in command execution workflows.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| salt | pip | < 2015.8.13 | 2015.8.13 |
| salt | pip | >= 2016.3.0, < 2016.11.5 | 2016.11.5 |
| salt |
| pip |
| >= 2016.11.7, < 2016.11.10 |
| 2016.11.10 |
| salt | pip | >= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| salt | pip | >= 2018.2.0, <= 2018.3.5 |
| salt | pip | >= 2019.2.0, < 2019.2.8 | 2019.2.8 |
| salt | pip | >= 3000, < 3000.7 | 3000.7 |
| salt | pip | >= 3001, < 3001.5 | 3001.5 |
| salt | pip | >= 3002, < 3002.3 | 3002.3 |
Ongoing coverage of React2Shell