Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-6bd4-ppra-pya5
Vulnerability ID VCID-6bd4-ppra-pya5
Aliases CVE-2015-6918
GHSA-q2x6-8gfj-hjxw
PYSEC-2017-70
Summary salt before 2015.5.5 leaks git usernames and passwords to the log.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
System Score Found at
epss 0.00298 https://api.first.org/data/v1/epss?cve=CVE-2015-6918
cvssv3.1 6.3 https://bugzilla.redhat.com/show_bug.cgi?id=1257154
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=1257154
cvssv3.1 6.3 https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-70.yaml
generic_textual MODERATE https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-70.yaml
cvssv3.1 6.3 https://github.com/saltstack/salt
generic_textual MODERATE https://github.com/saltstack/salt
cvssv3.1 6.3 https://github.com/saltstack/salt/commit/28aa9b105804ff433d8f663b2f9b804f2b75495a
generic_textual MODERATE https://github.com/saltstack/salt/commit/28aa9b105804ff433d8f663b2f9b804f2b75495a
cvssv3.1 6.3 https://github.com/saltstack/salt/issues/26484
generic_textual MODERATE https://github.com/saltstack/salt/issues/26484
cvssv3.1 6.3 https://github.com/saltstack/salt/pull/26486
generic_textual MODERATE https://github.com/saltstack/salt/pull/26486
cvssv3.1 6.3 https://nvd.nist.gov/vuln/detail/CVE-2015-6918
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2015-6918
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2015-6918
https://bugzilla.redhat.com/show_bug.cgi?id=1257154
https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-70.yaml
https://github.com/saltstack/salt
https://github.com/saltstack/salt/commit/28aa9b105804ff433d8f663b2f9b804f2b75495a
https://github.com/saltstack/salt/issues/26484
https://github.com/saltstack/salt/pull/26486
https://nvd.nist.gov/vuln/detail/CVE-2015-6918
USN-USN-4769-1 https://usn.ubuntu.com/USN-4769-1/
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=1257154
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-70.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/saltstack/salt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/saltstack/salt/commit/28aa9b105804ff433d8f663b2f9b804f2b75495a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/saltstack/salt/issues/26484
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/saltstack/salt/pull/26486
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2015-6918
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.53463
EPSS Score 0.00298
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:17:27.366093+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/salt/PYSEC-2017-70.yaml 38.6.0