CVE Vulnerabilities

CVE-2023-28434

Published: Mar 22, 2023 | Modified: Nov 07, 2023
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials with arn:aws:s3:::* permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off MINIO_BROWSER=off.

Affected Software

Name Vendor Start Version End Version
Minio Minio * 2023-03-20t20-16-18z (excluding)
Golang-github-minio-minio-go Ubuntu bionic *
Golang-github-minio-minio-go Ubuntu kinetic *
Golang-github-minio-minio-go Ubuntu lunar *
Golang-github-minio-minio-go Ubuntu trusty *
Golang-github-minio-minio-go Ubuntu xenial *
Golang-github-minio-minio-go-v7 Ubuntu kinetic *
Golang-github-minio-minio-go-v7 Ubuntu lunar *
Golang-github-minio-minio-go-v7 Ubuntu trusty *
Golang-github-minio-minio-go-v7 Ubuntu xenial *

References