CVE-2017-8109

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Apr 25, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-811010.0www.modified-shop.org modified eCommerce Shopsoftware 2.0.2.2 rev 10690 has XXE in api/it-recht-kanzlei/api-it-recht-kanzlei.php.CVE-2017-81126.5hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and CPUCVE-2017-81148.8Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.CVE-2017-81155.3Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remCVE-2017-81169.8The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute CVE-2017-81179.8The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper proceCVE-2017-81182.3The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some senCVE-2017-81199.8The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper proceCVE-2017-81209.8The UMA product with software V200R001 and V300R001 has a privilege elevation vulnerability due to insufficient validation or improper proceCVE-2017-81215.3The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some senCVE-2017-81229.8The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of paraCVE-2017-81239.8The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of para
CVE-2017-8109: High severity, CVSS 7.8 | Vulnix