Lucene search
GoogleOSV:BIT-MINIO-2023-28434HistoryMar 06, 2024 - 10:56 a.m.
BIT-minio-2023-28434
2024-03-0610:56:17
Google
osv.dev
5
minio
object storage
security patch
multi-cloud
postpolicybucket
crafted requests
aws s3 permission
console api access
browser api access.
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials with arn:aws:s3:::* permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off MINIO_BROWSER=off.
| CPE | Name | Operator | Version |
|---|---|---|---|
| minio | lt | 2023.03.20 |
Related
veracode
veracode
Privilege Escalation
2023-03-28 07:02:59
cgr
cgr
CVE-2023-28434 vulnerabilities
2024-05-19 03:07:16
attackerkb
attackerkb
CVE-2023-28434
2023-03-22 00:00:00
cvelist
cvelist
CVE-2023-28434 MinIO is vulnerable to privilege escalation on Linux/MacOS
2023-03-22 20:44:04
prion
prion
Code injection
2023-03-22 21:15:00
osv
osv
CVE-2023-28434
2023-03-22 21:15:18
Privilege Escalation on Linux/MacOS
2023-09-05 15:45:10
github
github
Privilege Escalation on Linux/MacOS
2023-09-05 15:45:10
alpinelinux
alpinelinux
CVE-2023-28434
2023-03-22 21:15:18
cve
cve
CVE-2023-28434
2023-03-22 21:15:18
cisa_kev
cisa_kev
MinIO Security Feature Bypass Vulnerability
2023-09-19 00:00:00
wolfi
wolfi
CVE-2023-28434 vulnerabilities
2024-05-31 15:28:21
ubuntucve
ubuntucve
CVE-2023-28434
2023-03-22 00:00:00
thn
thn
nessus
nessus
MinIO < RELEASE.2023-03-20T20-16-18Z Multiple Vulnerabilities
2023-09-26 00:00:00
wallarmlab
wallarmlab
Changes in OWASP API Security Top-10 2023RC | API Security Newsletter
2023-04-06 14:27:28