{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-22241", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2025-01-02T04:30:06.833Z", "datePublished": "2025-06-13T07:04:38.695Z", "dateUpdated": "2025-06-17T17:26:12.653Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "Salt", "product": "SALT", "vendor": "VMware", "versions": [{"lessThan": "3006.12", "status": "affected", "version": "3006.x", "versionType": "lts"}, {"lessThan": "3007.4", "status": "affected", "version": "3007.x", "versionType": "sts"}]}], "datePublic": "2025-06-12T07:33:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>File contents overwrite the VirtKey class is called when \u201con-demand pillar\u201d data is requested and uses un-validated input to create paths to the \u201cpki directory\u201d. The functionality is used to auto-accept Minion authentication keys based on a pre-placed \u201cauthorization file\u201d at a specific location and is present in the default configuration.<br></p>"}], "value": "File contents overwrite the VirtKey class is called when \u201con-demand pillar\u201d data is requested and uses un-validated input to create paths to the \u201cpki directory\u201d. The functionality is used to auto-accept Minion authentication keys based on a pre-placed \u201cauthorization file\u201d at a specific location and is present in the default configuration."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2025-06-13T07:04:38.695Z"}, "references": [{"url": "https://docs.saltproject.io/en/3006/topics/releases/3006.12.html"}, {"url": "https://docs.saltproject.io/en/3007/topics/releases/3007.4.html"}], "source": {"discovery": "UNKNOWN"}, "title": "CVE-2025-22241 salt advisory", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-13T15:24:21.315077Z", "id": "CVE-2025-22241", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T17:26:12.653Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-22241", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-13T15:24:21.315077Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-13T15:24:31.165Z"}}], "cna": {"title": "CVE-2025-22241 salt advisory", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VMware", "product": "SALT", "versions": [{"status": "affected", "version": "3006.x", "lessThan": "3006.12", "versionType": "lts"}, {"status": "affected", "version": "3007.x", "lessThan": "3007.4", "versionType": "sts"}], "packageName": "Salt", "defaultStatus": "unaffected"}], "datePublic": "2025-06-12T07:33:00.000Z", "references": [{"url": "https://docs.saltproject.io/en/3006/topics/releases/3006.12.html"}, {"url": "https://docs.saltproject.io/en/3007/topics/releases/3007.4.html"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "File contents overwrite the VirtKey class is called when \u201con-demand pillar\u201d data is requested and uses un-validated input to create paths to the \u201cpki directory\u201d. The functionality is used to auto-accept Minion authentication keys based on a pre-placed \u201cauthorization file\u201d at a specific location and is present in the default configuration.", "supportingMedia": [{"type": "text/html", "value": "<p>File contents overwrite the VirtKey class is called when \u201con-demand pillar\u201d data is requested and uses un-validated input to create paths to the \u201cpki directory\u201d. The functionality is used to auto-accept Minion authentication keys based on a pre-placed \u201cauthorization file\u201d at a specific location and is present in the default configuration.<br></p>", "base64": false}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2025-06-13T07:04:38.695Z"}}}, "cveMetadata": {"cveId": "CVE-2025-22241", "state": "PUBLISHED", "dateUpdated": "2025-06-17T17:26:12.653Z", "dateReserved": "2025-01-02T04:30:06.833Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2025-06-13T07:04:38.695Z", "assignerShortName": "vmware"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "File contents overwrite the VirtKey class is called when \u201con-demand pillar\u201d data is requested and uses un-validated input to create paths to the \u201cpki directory\u201d. The functionality is used to auto-accept Minion authentication keys based on a pre-placed \u201cauthorization file\u201d at a specific location and is present in the default configuration."}, {"lang": "es", "value": "El contenido del archivo sobrescribe la clase VirtKey, que se invoca cuando se solicitan datos del pilar bajo demanda y utiliza datos no validados para crear rutas al directorio PKI. Esta funci\u00f3n se utiliza para aceptar autom\u00e1ticamente las claves de autenticaci\u00f3n de Minion bas\u00e1ndose en un archivo de autorizaci\u00f3n preinstalado en una ubicaci\u00f3n espec\u00edfica y est\u00e1 presente en la configuraci\u00f3n predeterminada."}], "id": "CVE-2025-22241", "lastModified": "2025-06-17T18:15:25.043", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.3, "impactScore": 5.2, "source": "security@vmware.com", "type": "Secondary"}]}, "published": "2025-06-13T07:15:21.567", "references": [{"source": "security@vmware.com", "url": "https://docs.saltproject.io/en/3006/topics/releases/3006.12.html"}, {"source": "security@vmware.com", "url": "https://docs.saltproject.io/en/3007/topics/releases/3007.4.html"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}