CVE-2024-38825

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Jun 13, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-388265.3Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of CVE-2024-388274.8The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorizati CVE-2024-388285.3Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.CVE-2024-388293.7A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3,CVE-2024-38835.4The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Bookmark URL field in all versions up to, and incl CVE-2024-388307.8VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigg CVE-2024-388317.8VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can inse CVE-2024-388326.4VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to i CVE-2024-388335.4VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might CVE-2024-388344.8VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might b CVE-2024-38847.5A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(Str CVE-2024-38855.4The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the subcontainer value parameter in a