Skip to content
OpenAdvisories
High 2 exploited CVEs WID-SEC-2023-2261 2 CVEs

MinIO: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Sep 4, 2023 · Updated Sep 4, 2023 · de-DE

Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MinIO ausnutzen, um Informationen offenzulegen.

Product

MinIO ist ein S3-kompatibler Objektspeicher, der für groß angelegte KI/ML-, Data Lake- und Datenbank-Workloads entwickelt wurde. Er läuft "on-premise" und in jeder Cloud.

Vulnerabilities 2

  • High 8.8
    CVE-2023-28434 Exploited Public exploit

    MinIO is vulnerable to privilege escalation on Linux/MacOS

    Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attac…

    minio minio minio minio-iamguarded-2025-compat Wolfi Go
    KEV Sep 19, 2023
  • High 7.5
    CVE-2023-28432 Exploited Public exploit Scanner template EPSS 84%

    Minio Information Disclosure in Cluster Deployment

    Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, res…

    minio minio
    KEV Apr 21, 2023

Revision history

  1. #1

    Initiale Fassung

References