Vulnerabilities > CVE-2021-3144 - Insufficient Session Expiration vulnerability in multiple products

CVSS 9.1 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

critical

NVD

Published: 2021-02-27

Updated: 2023-12-21

Summary

In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)

Vulnerable Configurations

Part	Description	Count
Application	Saltstack Saltstack Salt 2019.2.0 Saltstack Salt 2019.2.1 Saltstack Salt 2019.2.2 Saltstack Salt 2019.2.3 Saltstack Salt 2019.2.4 Saltstack Salt 2016.3.7 Saltstack Salt 2016.11.7 Saltstack Salt 2016.11.8 Saltstack Salt 2016.11.9 Saltstack Salt 2016.3.5 Saltstack Salt 2015.8.11 Saltstack Salt 2015.8.12 Saltstack Salt 2016.3.0 Saltstack Salt 2016.3.1 Saltstack Salt 2016.3.2 Saltstack Salt 2016.3.3 Saltstack Salt 0.6.0 Saltstack Salt 0.7.0 Saltstack Salt 0.8.0 Saltstack Salt 0.8.7 Saltstack Salt 0.8.8 Saltstack Salt 0.8.9 Saltstack Salt 0.9.0 Saltstack Salt 0.9.1 Saltstack Salt 0.9.2 Saltstack Salt 0.9.3 Saltstack Salt 0.9.4 Saltstack Salt 0.9.5 Saltstack Salt 0.9.6 Saltstack Salt 0.9.7 Saltstack Salt 0.9.8 Saltstack Salt 0.9.9 Saltstack Salt 0.10.0 Saltstack Salt 0.10.1 Saltstack Salt 0.10.2 Saltstack Salt 0.10.3 Saltstack Salt 0.10.4 Saltstack Salt 0.10.5 Saltstack Salt 0.11.0 Saltstack Salt 0.11.1 Saltstack Salt 0.12.0 Saltstack Salt 0.12.1 Saltstack Salt 0.13.0 Saltstack Salt 0.13.1 Saltstack Salt 0.13.2 Saltstack Salt 0.13.3 Saltstack Salt 0.14.0 Saltstack Salt 0.14.1 Saltstack Salt 0.15.0 Saltstack Salt 0.15.1 Saltstack Salt 0.15.2 Saltstack Salt 0.15.3 Saltstack Salt 0.15.90 Saltstack Salt 0.16.0 Saltstack Salt 0.16.1 Saltstack Salt 0.16.2 Saltstack Salt 0.16.3 Saltstack Salt 0.16.4 Saltstack Salt 0.17.0 Saltstack Salt 0.17.1 Saltstack Salt 0.17.2 Saltstack Salt 0.17.3 Saltstack Salt 0.17.4 Saltstack Salt 0.17.5 Saltstack Salt 2014.1.0 Saltstack Salt 2014.1.1 Saltstack Salt 2014.1.2 Saltstack Salt 2014.1.3 Saltstack Salt 2014.1.4 Saltstack Salt 2014.1.5 Saltstack Salt 2014.1.6 Saltstack Salt 2014.1.7 Saltstack Salt 2014.1.8 Saltstack Salt 2014.1.9 Saltstack Salt 2014.1.10 Saltstack Salt 2014.1.11 Saltstack Salt 2014.1.12 Saltstack Salt 2014.1.13 Saltstack Salt 2014.7.0 Saltstack Salt 2014.7.1 Saltstack Salt 2014.7.2 Saltstack Salt 2014.7.3 Saltstack Salt 2014.7.4 Saltstack Salt 2014.7.5 Saltstack Salt 2014.7.6 Saltstack Salt 2014.7.7 Saltstack Salt 2014.7.8 Saltstack Salt 2014.7.9 Saltstack Salt 2015.2.0 Saltstack Salt 2015.5.0 Saltstack Salt 2015.5.1 Saltstack Salt 2015.5.2 Saltstack Salt 2015.5.3 Saltstack Salt 2015.5.4 Saltstack Salt 2015.5.5 Saltstack Salt 2015.5.6 Saltstack Salt 2015.5.7 Saltstack Salt 2015.5.8 Saltstack Salt 2015.5.9 Saltstack Salt 2015.5.10 Saltstack Salt 2015.5.11 Saltstack Salt 2015.8.0 Saltstack Salt 2015.8.1 Saltstack Salt 2015.8.2 Saltstack Salt 2015.8.3 Saltstack Salt 2015.8.4 Saltstack Salt 2015.8.5 Saltstack Salt 2015.8.6 Saltstack Salt 2015.8.7 Saltstack Salt 2015.8.8 Saltstack Salt 2015.8.8.2 Saltstack Salt 2015.8.9 Saltstack Salt 2016.3.9 Saltstack Salt 2016.11.0 Saltstack Salt 2016.11.1 Saltstack Salt 2016.11.2 Saltstack Salt 2016.11.4 Saltstack Salt 2017.5.0 Saltstack Salt 2017.7.0 Saltstack Salt 2017.7.1 Saltstack Salt 2017.7.2 Saltstack Salt 2017.7.3 Saltstack Salt 2017.7.4 Saltstack Salt 2017.7.5 Saltstack Salt 2017.7.6 Saltstack Salt 2017.7.7 Saltstack Salt 2018.2.0 Saltstack Salt 2018.3.0 Saltstack Salt 2018.3.1 Saltstack Salt 2018.3.2 Saltstack Salt 2018.3.3 Saltstack Salt 2018.3.4 Saltstack Salt 2019.2.6 Saltstack Salt 2019.2.7 Saltstack Salt 3000 Saltstack Salt 3000.0 Saltstack Salt 3000.1 Saltstack Salt 3000.2 Saltstack Salt 3000.3 Saltstack Salt 3000.4 Saltstack Salt 3000.5 Saltstack Salt 3001 Saltstack Salt 3001.1 Saltstack Salt 3001.2 Saltstack Salt 3001.3 Saltstack Salt 3002 Saltstack Salt 3002.1 Saltstack Salt 3002.2 Saltstack Salt 3002.3 Saltstack Salt 3002.4	179
OS	Fedoraproject Fedoraproject Fedora 32 Fedoraproject Fedora 33 Fedoraproject Fedora 34	3
OS	Debian Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0	3

Common Weakness Enumeration (CWE)

CWE-613 - Insufficient Session Expiration

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References