CVE-2014-3563
SaltStack Salt Insecure Temporary File Creation
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
Exploit likelihood
What each source reports
NVD Score used
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
- Record
CVE-2014-3563- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
- Record
CVE-2014-3563- Updated
- 2026-11-02
EUVDEUVD-2014-0103 No score
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
- Record
EUVD-2014-0103- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mfr3-9cj8-h2qm No score
SaltStack Salt Insecure Temporary File Creation
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
- Record
GHSA-mfr3-9cj8-h2qm- Weakness
- CWE-59
- Updated
- 2026-11-02
OSVGHSA-mfr3-9cj8-h2qm No score
SaltStack Salt Insecure Temporary File Creation
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
- Record
GHSA-mfr3-9cj8-h2qm- Weakness
- CWE-59
- Updated
- 2026-11-02
OSVPYSEC-2014-18 No score
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
- Record
PYSEC-2014-18- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3563 No score
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
- Record
UBUNTU-CVE-2014-3563- Updated
- 2026-11-02
OSVUSN-4769-1 No score
salt vulnerabilities
It was discovered that Salt allowed remote attackers to write to arbitrary files via a special crafted file. An attacker could use this vulnerability to cause a DoS or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 ESM. (CVE-2014-3563)
Andreas Stieger discovered that Salt exposed git usernames and passwords in log files. An attacker could use this issue to retrieve sensitive information. This issue only affected Ubuntu 14.04 ESM. (CVE-2015-6918).
It was discovered that Salt exposed password authentication credentials in log files. An attacker could use this issue to retrieve sensitive information. This issue only affected Ubuntu 14.04 ESM. (CVE-2015-6941)
It was discovered that Salt allowed remote attackers to write to arbitrary files via a special crafted file. An attacker could use this issue to cause a DoS or possibly execute arbitrary code. (CVE-2017-12791, CVE-2017-14695, CVE-2017-14696)
It was discovered that Salt allowed remote attackers to determine which files exist on the server. An attacker could use this issue to extract sensitive information. This issue only affected Ubuntu 16.04 ESM. (CVE-2018-15750)
It was discovered that Salt allowed users to bypass authentication. An attacker could use this issue to extract sensitive information, execute arbitrary code or crash the server. This issue only affected Ubuntu 16.04 ESM. (CVE-2018-15751)
- Record
USN-4769-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
saltPyPI |
before 2014.1.10 | 2014.1.10 |
saltPyPI |
before 2014.1.10, plus listed versions 0.10.00.10.10.10.20.10.30.10.4 Show 45 moreShow less0.10.50.11.00.11.10.12.00.12.10.13.00.13.10.13.20.13.30.14.00.14.10.15.00.15.10.15.20.15.30.15.900.16.00.16.10.16.20.16.30.16.40.17.00.17.0rc10.17.10.17.20.17.30.17.40.17.50.8.70.8.90.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.90.9.9.12014.1.02014.1.0rc12014.1.0rc22014.1.0rc3 |
2014.1.10 |
saltUbuntu:Pro:14.04:LTS |
before 0.17.5+ds-1ubuntu0.1~esm1, plus listed versions 0.16.0-10.16.4-20.17.1+dfsg-10.17.2-10.17.2-2 Show 5 moreShow less0.17.2-30.17.4-10.17.4-20.17.5-10.17.5+ds-1 |
0.17.5+ds-1ubuntu0.1~esm1 |
saltUbuntu:Pro:16.04:LTS |
before 2015.8.8+ds-1ubuntu0.1+esm1, plus listed versions 2015.5.3+ds-12015.8.1+ds-22015.8.3+ds-12015.8.3+ds-22015.8.3+ds-3 Show 5 moreShow less2015.8.5+ds-12015.8.7+ds-12015.8.8+ds-12015.8.8+ds-1ubuntu0.1~esm12015.8.8+ds-1ubuntu0.1 |
2015.8.8+ds-1ubuntu0.1+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3563 is a high vulnerability (CVSS 7.2) in Saltstack Salt, published August 22, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in salt 2014.1.10.
References
exchange.xforce.ibmcloud.com/vulnerabilities/95392
seclists.org/oss-sec/2014/q3/428
securityfocus.com/bid/69319
docs.saltstack.com/en/latest/topics/releases/2014.1.10.html
nvd.nist.gov/vuln/detail/CVE-2014-3563
github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2014-18.yaml
Show 15 moreShow less
ubuntu.com/security/CVE-2014-3563
xforce.iss.net/xforce/xfdb/95392
cve.org/CVERecord?id=CVE-2014-3563
Left out here: 9 versions. The JSON record has them.