VulnerabilityModified
CVE-2020-11012
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API.
HIGH 7.5EPSS 1.87%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.87%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 1.87% probability · 78th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-305, CWE-755
- Affected
- minio/minio
- Source
- security-advisories@github.com
References
- https://github.com/minio/minio/commit/4cd6ca02c7957aeb2de3eede08b0754332a77923Patch, Third Party Advisory
- https://github.com/minio/minio/pull/9422Third Party Advisory
- https://github.com/minio/minio/releases/tag/RELEASE.2020-04-23T00-58-49ZThird Party Advisory
- https://github.com/minio/minio/security/advisories/GHSA-xv4r-vccv-mg4wPatch, Third Party Advisory
- https://github.com/minio/minio/commit/4cd6ca02c7957aeb2de3eede08b0754332a77923Patch, Third Party Advisory
- https://github.com/minio/minio/pull/9422Third Party Advisory
- https://github.com/minio/minio/releases/tag/RELEASE.2020-04-23T00-58-49ZThird Party Advisory
- https://github.com/minio/minio/security/advisories/GHSA-xv4r-vccv-mg4wPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.