CVE-2018-15750

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html
https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.htmlRelease Notes, Vendor Advisory
https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.htmlRelease Notes, Vendor Advisory
https://groups.google.com/d/msg/salt-users/L9xqcJ0UXxs/qgDj42obBQAJRelease Notes, Third Party Advisory
https://groups.google.com/d/msg/salt-users/dimVF7rpphY/jn3Xv3MbBQAJRelease Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00024.html
https://usn.ubuntu.com/4459-1/
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html
https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.htmlRelease Notes, Vendor Advisory
https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.htmlRelease Notes, Vendor Advisory
https://groups.google.com/d/msg/salt-users/L9xqcJ0UXxs/qgDj42obBQAJRelease Notes, Third Party Advisory
https://groups.google.com/d/msg/salt-users/dimVF7rpphY/jn3Xv3MbBQAJRelease Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00024.html
https://usn.ubuntu.com/4459-1/

Timeline

Published: Oct 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-157519.8SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands v CVE-2018-157528.1An issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android. Cleartext Transmission of Sensitive Inform CVE-2018-157537.5An issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android. The use of a Hard-coded DES Cryptographic CVE-2018-157548.8Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that co CVE-2018-157558.8Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between D CVE-2018-157567.5Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x b CVE-2018-157588.1Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsup CVE-2018-157599.8Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials. A remote unauthent CVE-2018-157618.8Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privileg CVE-2018-157628.8Pivotal Operations Manager, versions 2.0.x prior to 2.0.24, versions 2.1.x prior to 2.1.15, versions 2.2.x prior to 2.2.7, and versions 2.3.CVE-2018-157638.8Pivotal Container Service, versions prior to 1.2.0, contains an information disclosure vulnerability which exposes IaaS credentials to appli CVE-2018-157649.8Dell EMC ESRS Policy Manager versions 6.8 and prior contain a remote code execution vulnerability due to improper configurations of triggere