CVE-2024-38822

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Jun 13, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-388232.7Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.CVE-2024-388247.5Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.CVE-2024-388256.4The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated againCVE-2024-388265.3Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial ofCVE-2024-388274.8The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorizatiCVE-2024-388285.3Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.CVE-2024-388293.7A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3,CVE-2024-38835.4The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Bookmark URL field in all versions up to, and inclCVE-2024-388307.8VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may triggCVE-2024-388317.8VMware Aria Operations contains a local privilege escalation vulnerability.  A malicious actor with local administrative privileges can inseCVE-2024-388326.4VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to iCVE-2024-388335.4VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might
CVE-2024-38822: Low severity, CVSS 2.7 | Vulnix