CVE-2021-3197

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Feb 27, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-319705.5Windows TCP/IP Driver Security Feature Bypass VulnerabilityCVE-2021-319716.8Windows HTML Platforms Security Feature Bypass VulnerabilityCVE-2021-319725.5Event Tracing for Windows Information Disclosure VulnerabilityCVE-2021-319737.8Windows GPSVC Elevation of Privilege VulnerabilityCVE-2021-319747.5Server for NFS Denial of Service VulnerabilityCVE-2021-319757.5Server for NFS Information Disclosure VulnerabilityCVE-2021-319767.5Server for NFS Information Disclosure VulnerabilityCVE-2021-319778.6Windows Hyper-V Denial of Service VulnerabilityCVE-2021-319785.5Microsoft Defender Denial of Service VulnerabilityCVE-2021-319797.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2021-31987.2By abusing the 'install rpm url' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. CVE-2021-319808.1Microsoft Intune Management Extension Remote Code Execution Vulnerability
CVE-2021-3197: Critical severity, CVSS 9.8 | Vulnix