CVE-2023-25812mediumCWE-281

CVE-2023-25812: medium-severity vulnerability in minio

Allowed DELETE on resources on object locked buckets under Governance mode in Minio

Published · Updated

Follow this CVE+ Monitor minio

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 1.0%
Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Governance-Retention: true`. However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted. All users are advised to upgrade. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected products
minio · minio
Related CVEs — minio

In the same product, most dangerous first.

CVE-2023-28432HIGHMinio Information Disclosure in Cluster DeploymentEPSS 84.0%KEVCVE-2023-28434HIGHMinIO is vulnerable to privilege escalation on Linux/MacOSEPSS 7.9%KEVCVE-2022-35919HIGHAuthenticated requests for server update admin API allows path traversal in minioEPSS 52.1%CVE-2021-43858HIGHUser privilege escalation in MinIOEPSS 35.5%CVE-2024-24747HIGHMinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalationEPSS 34.1%CVE-2021-21287HIGHServer-Side Request Forgery in MinIO Browser APIEPSS 23.9%