VMware Salt Project vulnerabilities

2 CVEs affecting VMware Salt Project, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-22232, published 2024-06-27.

More from VMware.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-22232, published 2024-06-27. High severity, CVSS 7.7. EPSS: 0.8% chance of exploitation in the next 30 days. A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem.
• CVE-2024-22231, published 2024-06-27. Medium severity, CVSS 5.0. EPSS: 0.7% chance of exploitation in the next 30 days. Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master.