VYPR
← All advisories
Moderate severityNVD Advisory· Published Feb 27, 2021· Updated Aug 3, 2024

CVE-2021-25284

CVE-2021-25284

Description

An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

SaltStack Salt before 3002.5 logs credentials from salt.modules.cmdmod to info or error log levels.

Vulnerability

CVE-2021-25284 is a security flaw in SaltStack Salt affecting versions prior to 3002.5. The issue resides in the salt.modules.cmdmod module, which inadvertently logs credentials at the info or error log level [1][2]. This means that sensitive information such as passwords or authentication tokens may be written to log files during normal operation.

Exploitation

Exploitation does not require direct network access to the vulnerable function; rather, any user or process with read access to the Salt log files could potentially retrieve the exposed credentials. The vulnerability is triggered when cmdmod is invoked with credentials that are passed as arguments, and the module logs these inputs at an inappropriate severity level [1].

Impact

An attacker who gains access to the log files could obtain credentials used by Salt operations. This could lead to privilege escalation, unauthorized access to managed systems, or compromise of the Salt infrastructure itself [1].

Mitigation

The vulnerability is fixed in Salt version 3002.5 and later [2][4]. Users are advised to upgrade to the patched version. As of the publication date, no workarounds have been documented, and the issue is not known to be listed in the US CISA KEV catalog.

References
  1. NVD - CVE-2021-25284
  2. Releases · saltstack/salt
  3. advisory-database/vulns/salt/PYSEC-2021-53.yaml at main · pypa/advisory-database

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
saltPyPI
< 2015.8.132015.8.13
saltPyPI
>= 2016.3.0, < 2016.11.52016.11.5
saltPyPI
>= 2016.11.7, < 2016.11.102016.11.10
saltPyPI
>= 2017.5.0, < 2017.7.82017.7.8
saltPyPI
>= 2018.2.0, <= 2018.3.5—
saltPyPI
>= 2019.2.0, < 2019.2.82019.2.8
saltPyPI
>= 3000, < 3000.73000.7
saltPyPI
>= 3001, < 3001.53001.5
saltPyPI
>= 3002, < 3002.33002.3

Affected products

32

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

22

News mentions

0

No linked articles in our index yet.