Vulnerability · Published Mar 14, 2023 · Assigned by GitHub_M

CVE-2023-27589Minio vulnerable to denial of access by an admin privileged user for root credential

Medium 6.5

In plain English

A medium-severity privilege mismanagement in minio from minio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.9%top 40.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with `consoleAdmin` permissions can potentially create a user that matches the root credential `accessKey`. Once this user is created successfully, the root credential ceases to work appropriately. The issue is patched in RELEASE.2023-03-13T19-46-17Z. There are ways to work around this via adding higher privileges to the disabled root user via `mc admin policy set`.

Affected products (as reported)

Vendor	Product	Versions
minio	minio	>= RELEASE.2020-12-23T02-24-12Z, < RELEASE.2023-03-13T19-46-17Z

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

References

https://github.com/minio/minio/security/advisories/GHSA-9wfv-wmf7-6753 x_refsource_CONFIRM
https://github.com/minio/minio/pull/16803 x_refsource_MISC