Vulnerability · Published Apr 23, 2020 · Assigned by GitHub_M

CVE-2020-11012Authentication bypass MinIO Admin API

Critical 9.3

In plain English

A critical-severity security flaw in minio from MinIO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)1.9%top 20.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	minio	0.20200423-r0	ALPINE-CVE-2020-11012
Alpine:v3.21	minio	0.20200423-r0	ALPINE-CVE-2020-11012
Alpine:v3.22	minio	0.20200423-r0	ALPINE-CVE-2020-11012
Alpine:v3.23	minio	0.20200423-r0	ALPINE-CVE-2020-11012
Alpine:v3.24	minio	0.20200423-r0	ALPINE-CVE-2020-11012

Affected products (as reported)

Vendor	Product	Versions
MinIO	minio	< RELEASE.2020-04-23T00-58-49Z

Weakness: CWE-305 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

References

https://github.com/minio/minio/security/advisories/GHSA-xv4r-vccv-mg4w x_refsource_CONFIRM
https://github.com/minio/minio/pull/9422 x_refsource_MISC
https://github.com/minio/minio/commit/4cd6ca02c7957aeb2de3eede08b0754332a77923 x_refsource_MISC
https://github.com/minio/minio/releases/tag/RELEASE.2020-04-23T00-58-49Z x_refsource_MISC