CVE-2023-25812mediumCWE-281

CVE-2023-25812: falha de média gravidade em minio

Allowed DELETE on resources on object locked buckets under Governance mode in Minio

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar minio

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 1.0%
Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Governance-Retention: true`. However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted. All users are advised to upgrade. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Produtos afetados
minio · minio
CVEs relacionadas — minio

No mesmo produto, das mais perigosas para as menos.

CVE-2023-28432HIGHMinio Information Disclosure in Cluster DeploymentEPSS 84.0%KEVCVE-2023-28434HIGHMinIO is vulnerable to privilege escalation on Linux/MacOSEPSS 7.9%KEVCVE-2022-35919HIGHAuthenticated requests for server update admin API allows path traversal in minioEPSS 52.1%CVE-2021-43858HIGHUser privilege escalation in MinIOEPSS 35.5%CVE-2024-24747HIGHMinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalationEPSS 34.1%CVE-2021-21287HIGHServer-Side Request Forgery in MinIO Browser APIEPSS 23.9%