CVE-2023-28434

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-28434
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5 Patch
https://github.com/minio/minio/pull/16849 Exploit Issue Tracking
https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*
History

07 Nov 2023, 04:10

Type Values Removed Values Added
Summary Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`. Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.

28 Mar 2023, 16:24

Type Values Removed Values Added
References (MISC) https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5 - (MISC) https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5 - Patch
References (MISC) https://github.com/minio/minio/pull/16849 - (MISC) https://github.com/minio/minio/pull/16849 - Exploit, Issue Tracking
References (MISC) https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c - (MISC) https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c - Vendor Advisory
CPE cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*
CWE CWE-269 NVD-CWE-noinfo
First Time Minio minio
Minio
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

22 Mar 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-03-22 21:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-28434

Mitre link : CVE-2023-28434

CVE.ORG link : CVE-2023-28434

JSON object : View

Products Affected

minio

  • minio
CWE
NVD-CWE-noinfo CWE-269

Improper Privilege Management