CVE-2021-41137CWE-285

Bypassing policy restrictions on regular users

High · published October 13, 2021

CVSS v3.1
8.8
EPSS
1%
Percentile
69.9
In the wild
Unconfirmed
What it is

Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerability that involves bypassing policy restrictions on regular users. Normally, checkKeyValid() should return owner true for rootCreds. In the affected version, policy restriction did not work properly for users who did not have service (svc) or security token service (STS) accounts. This issue is fixed in `RELEASE.2021-10-13T00-23-17Z`. A downgrade back to release `RELEASE.2021-10-08T23-58-24Z` is available as a workaround.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01285 · 69.9th percentile
Weakness
CWE-285 · Improper Authorization
Published
2021-10-13T14:00Z
EPSS history
Timeline
  • 13 OCT 14:00Z
    Bypassing policy restrictions on regular users
    cvelistv5