-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| salt | pip | < 2015.8.13 | 2015.8.13 |
| salt | pip | >= 2016.3.0, < 2016.11.5 | 2016.11.5 |
| salt | pip | >= 2016.11.7, < 2016.11.10 | 2016.11.10 |
| salt | pip | >= 2017.5.0, < 2017.7.8 | 2017.7.8 |
| salt | pip | >= 2018.2.0, <= 2018.3.5 | |
| salt | pip | >= 2019.2.0, < 2019.2.8 | 2019.2.8 |
| salt | pip | >= 3000, < 3000.7 | 3000.7 |
| salt | pip | >= 3001, < 3001.5 | 3001.5 |
| salt | pip | >= 3002, < 3002.3 | 3002.3 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability description explicitly names salt.utils.thin.gen_thin() as the vulnerable function and links it to CWE-77 (Command Injection). Release notes for patched versions (3002.3, 3001.5, etc.) confirm this function was fixed for command injection via quote handling. The file path 'salt/utils/thin.py' is directly referenced in both CVE descriptions and SaltStack's own security advisories.