CVE-2019-1010259

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
SaltStack	Salt	2018.3, 2019.2 [fixed: 2018.3.4]

References

https://github.com/ShantonRU/salt/commit/a46c86a987c78e74e87969d8d3b27094e6544b7aPatch, Third Party Advisory
https://github.com/saltstack/salt/blob/f22de0887cd7167887f113bf394244b74fb36b6b/salt/modules/mysql.py#L1534Exploit, Third Party Advisory
https://github.com/saltstack/salt/pull/51462Issue Tracking, Patch, Third Party Advisory
https://github.com/ShantonRU/salt/commit/a46c86a987c78e74e87969d8d3b27094e6544b7aPatch, Third Party Advisory
https://github.com/saltstack/salt/blob/f22de0887cd7167887f113bf394244b74fb36b6b/salt/modules/mysql.py#L1534Exploit, Third Party Advisory
https://github.com/saltstack/salt/pull/51462Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jul 18, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-10102608.1Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM.CVE-2019-10102616.1Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in b CVE-2019-10102639.8Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providin CVE-2019-10102666.5lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date CVE-2019-10102689.8Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Dis CVE-2019-10102759.8helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server CVE-2019-10102797.5Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. The impa CVE-2019-10102837.5Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. Th CVE-2019-10102876.1Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML CVE-2019-10102906.1Babel: Multilingual site Babel All is affected by: Open Redirection. The impact is: Redirection to any URL, which is supplied to redirect.ph CVE-2019-10102929.8Linaro/OP-TEE OP-TEE Prior to version v3.4.0 is affected by: Boundary checks. The impact is: This could lead to corruption of any memory whi CVE-2019-10102939.8Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Boundary crossing. The impact is: Memory corruption of the TEE itself. The component