CVE-2021-33226

CVE Database · CVE-2021-33226

CVE-2021-33226

· CRITICALModified

CVSS v3.1

9.8

EPSS

1.64%

Published

Feb 17, 2023

Modified

Mar 18, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. NOTE: this is disputed by third parties because an attacker cannot influence the eval input

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-120CWE-120

Affected Products (1)

saltstack · saltvulnerable

References (4)

https://bugzilla.suse.com/show_bug.cgi?id=1208473

https://github.com/saltstack/salt/blob/master/salt/modules/status.py

ExploitVendor Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1208473

https://github.com/saltstack/salt/blob/master/salt/modules/status.py

ExploitVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs