QwikSec

Security Database

CVE

CWE

Training

CVE-2020-11012

Published: Apr 23, 2020

Modified: Aug 4, 2024

PUBLISHED

CVSS v3.1

9.3

CRITICAL

Description

MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.

Vendor	Product	Versions
MinIO	minio	affected `< RELEASE.2020-04-23T00-58-49Z`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

References

https://github.com/minio/minio/security/advisories/GHSA-xv4r-vccv-mg4w

x_refsource_CONFIRM

https://github.com/minio/minio/pull/9422

x_refsource_MISC

https://github.com/minio/minio/commit/4cd6ca02c7957aeb2de3eede08b0754332a77923

x_refsource_MISC

https://github.com/minio/minio/releases/tag/RELEASE.2020-04-23T00-58-49Z

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.