CVE-2022-35919CWE-22

Authenticated requests for server update admin API allows path traversal in minio

High · published August 1, 2022

Patch now

High probability of exploitation

CVSS calls it high at 7.4. It sits in the 99.0th percentile for exploit probability.

CVSS v3.1
7.4
EPSS
52%
Percentile
99.0
In the wild
Unconfirmed
What it is

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin:ServerUpdate` can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow access to contents at any arbitrary paths that are readable by MinIO process. Users are advised to upgrade. Users unable to upgrade may disable ServerUpdate API by denying the `admin:ServerUpdate` action for your admin users via IAM policies.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.52144 · 99.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2022-08-01T00:00Z
EPSS history
Timeline
  • 01 AUG 00:00Z
    Authenticated requests for server update admin API allows path traversal in minio
    cvelistv5