CVE-2017-12791

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.

• CWE-22

• http://www.securityfocus.com/bid/100384Third Party Advisory, VDB Entry
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872399Issue Tracking, Patch, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1482006Issue Tracking, Patch, Third Party Advisory
• https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.7.htmlPatch, Release Notes, Vendor Advisory
• https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.htmlPatch, Release Notes, Vendor Advisory
• https://github.com/saltstack/salt/pull/42944Issue Tracking, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/100384Third Party Advisory, VDB Entry
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872399Issue Tracking, Patch, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1482006Issue Tracking, Patch, Third Party Advisory
• https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.7.htmlPatch, Release Notes, Vendor Advisory
• https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.htmlPatch, Release Notes, Vendor Advisory
• https://github.com/saltstack/salt/pull/42944Issue Tracking, Patch, Third Party Advisory

Published

Aug 23, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-12786Network interfaces of the cliengine and noviengine services,…
• CVE-2017-12787A network interface of the novi_process_manager_daemon servi…
• CVE-2017-12788Multiple cross-site scripting (XSS) vulnerabilities in admin…
• CVE-2017-12789Metinfo 5.3.18 is affected by: Cross Site Request Forgery (C…
• CVE-2017-1279IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could al…
• CVE-2017-12790Metinfo 5.3.18 is affected by: Cross Site Request Forgery (C…
• CVE-2017-12792Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2017-12794In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTM…
• CVE-2017-12795OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (…
• CVE-2017-12796The Reporting Compatibility Add On before 2.0.4 for OpenMRS,…
• CVE-2017-12797Integer overflow in the INT123_parse_new_id3 function in the…
• CVE-2017-12798Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 v…