Lucene search

GoogleOSV:CVE-2022-35919

HistoryAug 01, 2022 - 10:15 p.m.

CVE-2022-35919

2022-08-0122:15:10

Google

osv.dev

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

6.7 Medium

AI Score

Confidence

Low

3.3 Low

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:M/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

64.2%

JSON

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all ‘admin’ users authorized for admin:ServerUpdate can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow access to contents at any arbitrary paths that are readable by MinIO process. Users are advised to upgrade. Users unable to upgrade may disable ServerUpdate API by denying the admin:ServerUpdate action for your admin users via IAM policies.

CPENameOperatorVersion
minioeqRELEASE.2018-09-01T00-38-25Z
minioeqRELEASE.2020-04-23T00-58-49Z
minioeqRELEASE.2022-04-26T01-20-24Z
minioeqRELEASE.2021-08-05T22-01-19Z
minioeqRELEASE.2021-05-26T00-22-46Z
minioeqRELEASE.2019-03-20T22-38-47Z
minioeqRELEASE.2020-07-13T18-09-56Z
minioeqRELEASE.2022-04-30T22-23-53Z
minioeqRELEASE.2022-07-17T15-43-14Z
minioeqRELEASE.2022-05-08T23-50-31Z

Name	Operator	Version
minio	eq	RELEASE.2018-09-01T00-38-25Z
minio	eq	RELEASE.2020-04-23T00-58-49Z
minio	eq	RELEASE.2022-04-26T01-20-24Z
minio	eq	RELEASE.2021-08-05T22-01-19Z
minio	eq	RELEASE.2021-05-26T00-22-46Z
minio	eq	RELEASE.2019-03-20T22-38-47Z
minio	eq	RELEASE.2020-07-13T18-09-56Z
minio	eq	RELEASE.2022-04-30T22-23-53Z
minio	eq	RELEASE.2022-07-17T15-43-14Z
minio	eq	RELEASE.2022-05-08T23-50-31Z

Rows per page:

1-10 of 3241

References

packetstormsecurity.com/files/175010/Minio-2022-07-29T19-40-48Z-Path-Traversal.html

github.com/minio/minio/commit/bc72e4226e669d98c8e0f3eccc9297be9251c692

github.com/minio/minio/pull/15429

github.com/minio/minio/security/advisories/GHSA-gr9v-6pcm-rqvg

2.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

6.7 Medium

AI Score

Confidence

Low

3.3 Low

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:M/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

64.2%

JSON

Related for OSV:CVE-2022-35919