CVE-2020-11652: 
Python vulnerability analysis and mitigation

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users (NVD, MITRE).

The vulnerability is related to improper path sanitization in the ClearFuncs class of the salt-master process. The issue has a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (NVD).

The vulnerability allows authenticated users to gain arbitrary directory access to the salt-master filesystem. This could potentially lead to unauthorized access to sensitive information and system files (Salt Release Notes).

The vulnerability requires network access to ports 4505 or 4506 on the affected salt-master system. Exploit code has been publicly available, and the vulnerability has been actively exploited in the wild. The vulnerability has been added to CISA's Known Exploited Vulnerabilities Catalog (NVD).

The vulnerability has been fixed in Salt versions 2019.2.4 and 3000.2. Users are strongly advised to upgrade to these or later versions. Multiple vendors have released patches for their affected products, including VMware, Ubuntu, and Debian (VMware Advisory, Ubuntu Notice, Debian Advisory).