CVE-2023-27589CWE-269

Minio vulnerable to denial of access by an admin privileged user for root credential

Medium · published March 14, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with `consoleAdmin` permissions can potentially create a user that matches the root credential `accessKey`. Once this user is created successfully, the root credential ceases to work appropriately. The issue is patched in RELEASE.2023-03-13T19-46-17Z. There are ways to work around this via adding higher privileges to the disabled root user via `mc admin policy set`.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00898 · 59.2th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2023-03-14T18:22Z
EPSS history
Timeline
  • 14 MAR 18:22Z
    Minio vulnerable to denial of access by an admin privileged user for root credential
    cvelistv5