CVE-2016-3176

—

CVSS 3.0

5.6 medium

EPSS

<1%p57

Published

Jan 31, 2017 (Jan 31, 2017)

Modified

Jun 17, 2026

Description

Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.

Vendors: saltstack
Products: salt
Weakness: CWE-287
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.