Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-11652

96
FAUCET Score

CVE-2020-11652 is a path traversal vulnerability in SaltStack Salt before versions 2019.2.4 and 3000.2, allowing authenticated users to access arbitrary directories on the salt-master process. This medium-severity vulnerability (CVSS 6.5) has a low attack complexity and can lead to high confidentiality impact, affecting products from vendors like SaltStack, VMware, and Debian. It is actively exploited in the wild, with public exploit code available in Metasploit and ExploitDB, and has garnered significant community discussion and media coverage due to its use in high-profile attacks.

Impacted Technologies

VendorProductVersion(s)CPE
< 2019.2.4CPE matchmatch criteria
cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*
>= 3000, < 3000.2CPE matchmatch criteria
cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*
15.1CPE matchmatch criteria
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
8.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
9.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

6.5MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
86.06%
Probability of exploitation in next 30 days
EPSS Percentile
99.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
Added to KEV · Nov 3, 2021
Metasploit: SaltStack Salt Master/Minion Unauthenticated RCE · Apr 30, 2020
ExploitDB: EDB-48421 · May 5, 2020
This CVE's current EPSS score of 0.8606 is in the 100th percentile among its peer group of 21,939 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

pippatch availablevia ghsa
Product: saltFixed in: 2019.2.4
pippatch availablevia ghsa
Product: saltFixed in: 3000.2
redhatend of lifevia redhat_api
Product: Red Hat Ceph Storage 2Fixed in: salt

Vendor Advisories (2)

pipGHSA-vp49-2g4r-m3x3high

SaltStack Salt is vulnerable Arbitrary Directory Access

May 24, 2022
redhatCVE-2020-11652Moderate

salt: salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths

Apr 29, 2020

References

cisa.gov / known-exploited-vulnerabilities-catalog
US Government Resource
lists.opensuse.org / opensuse-security-announce/2020-04/msg00047.html
Mailing ListThird Party Advisory
lists.opensuse.org / opensuse-security-announce/2020-07/msg00070.html
Mailing ListThird Party Advisory
packetstormsecurity.com / files/157560/Saltstack-3000.1-Remote-Code-Execution.html
Third Party AdvisoryVDB Entry
packetstormsecurity.com / files/157678/SaltStack-Salt-Master-Minion-Unauthenticated-Remote-Code-Execution.html
ExploitThird Party AdvisoryVDB Entry
docs.saltstack.com / en/latest/topics/releases/2019.2.4.html
Vendor Advisory
github.com / saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rst
Third Party Advisory
lists.debian.org / debian-lts-announce/2020/05/msg00027.html
Mailing ListThird Party Advisory
tools.cisco.com / security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG
Third Party Advisory
support.blackberry.com / kb/articleDetail
Third Party Advisory
usn.ubuntu.com / 4459-1
Third Party Advisory
debian.org / security/2020/dsa-4676
Third Party Advisory
vmware.com / security/advisories/VMSA-2020-0009.html
Third Party Advisory