CVE-2020-11012

2020-04-2322:15:12

Google

osv.dev

7.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

45.7%

JSON

MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.

CPENameOperatorVersion
minioeqRELEASE.2018-04-19T22-54-58Z
minioeqRELEASE.2018-10-25T01-27-03Z
minioeqRELEASE.2019-09-05T23-24-38Z
minioeqRELEASE.2019-06-01T03-46-14Z
minioeqRELEASE.2019-10-02T21-19-38Z
minioeqRELEASE.2018-01-02T23-07-00Z
minioeqRELEASE.2016-06-03T19-32-05Z
minioeqRELEASE.2019-09-26T19-42-35Z
minioeqRELEASE.2019-02-20T22-44-29Z
minioeqRELEASE.2019-03-06T22-47-10Z

Name	Operator	Version
minio	eq	RELEASE.2018-04-19T22-54-58Z
minio	eq	RELEASE.2018-10-25T01-27-03Z
minio	eq	RELEASE.2019-09-05T23-24-38Z
minio	eq	RELEASE.2019-06-01T03-46-14Z
minio	eq	RELEASE.2019-10-02T21-19-38Z
minio	eq	RELEASE.2018-01-02T23-07-00Z
minio	eq	RELEASE.2016-06-03T19-32-05Z
minio	eq	RELEASE.2019-09-26T19-42-35Z
minio	eq	RELEASE.2019-02-20T22-44-29Z
minio	eq	RELEASE.2019-03-06T22-47-10Z