{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-15T16:35:49.998","vulnerabilities":[{"cve":{"id":"CVE-2022-22967","sourceIdentifier":"security@vmware.com","published":"2022-06-23T17:15:12.080","lastModified":"2025-05-05T17:17:54.853","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth."},{"lang":"es","value":"Se ha detectado un problema en SaltStack Salt en versiones anteriores a 3002.9, 3003.5, 3004.2. PAM auth falla al rechazar cuentas bloqueadas, lo que permite que un usuario previamente autorizado cuya cuenta está bloqueada siga ejecutando comandos de Salt cuando su cuenta está bloqueada. Esto afecta tanto a las cuentas locales de shell con una sesión activa como a usuarios de salt-api que son autenticados por medio de PAM eauth"}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*","versionEndExcluding":"3002.9","matchCriteriaId":"FE6336A6-0A0B-4E42-8990-2B32E19F2944"},{"vulnerable":true,"criteria":"cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*","versionStartIncluding":"3003","versionEndExcluding":"3003.5","matchCriteriaId":"D62A9E81-A4D3-4DEB-9998-FBAE7C49B35C"},{"vulnerable":true,"criteria":"cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*","versionStartIncluding":"3004","versionEndExcluding":"3004.2","matchCriteriaId":"11D7A914-2986-4732-8858-19EDC6F19468"}]}]}],"references":[{"url":"https://repo.saltproject.io/","source":"security@vmware.com","tags":["Product","Vendor Advisory"]},{"url":"https://saltproject.io/security_announcements/salt-security-advisory-release-june-21st-2022/%2C","source":"security@vmware.com","tags":["Broken Link"]},{"url":"https://security.gentoo.org/glsa/202310-22","source":"security@vmware.com","tags":["Third Party Advisory"]},{"url":"https://repo.saltproject.io/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product","Vendor Advisory"]},{"url":"https://saltproject.io/security_announcements/salt-security-advisory-release-june-21st-2022/%2C","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"https://security.gentoo.org/glsa/202310-22","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}