CVE-2024-55949CWE-269

Privilege escalation in IAM import API in MinIO

Critical · published December 16, 2024

CVSS v4.0
9.3
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in commit `f246c9053f9603e610d98439799bdd2a6b293427` which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00711 · 53.0th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2024-12-16T20:02Z
EPSS history
Timeline
  • 16 DEC 20:02Z
    Privilege escalation in IAM import API in MinIO
    cvelistv5