Lucene search

GoogleOSV:CVE-2023-27589

HistoryMar 14, 2023 - 7:15 p.m.

CVE-2023-27589

2023-03-1419:15:10

Google

osv.dev

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

6.8 Medium

AI Score

Confidence

High

4.7 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:M/C:N/I:P/A:P

0.001 Low

EPSS

Percentile

29.5%

JSON

Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with consoleAdmin permissions can potentially create a user that matches the root credential accessKey. Once this user is created successfully, the root credential ceases to work appropriately. The issue is patched in RELEASE.2023-03-13T19-46-17Z. There are ways to work around this via adding higher privileges to the disabled root user via mc admin policy set.

CPENameOperatorVersion
minioeqRELEASE.2021-11-03T03-36-36Z
minioeqRELEASE.2022-01-25T19-56-04Z
minioeqRELEASE.2021-02-24T18-44-45Z
minioeqRELEASE.2021-07-30T00-02-00Z
minioeqRELEASE.2021-06-17T00-10-46Z
minioeqRELEASE.2021-12-29T06-49-06Z
minioeqRELEASE.2023-01-20T02-05-44Z
minioeqRELEASE.2022-07-24T17-09-31Z
minioeqRELEASE.2021-03-04T00-53-13Z
minioeqRELEASE.2021-10-06T23-36-31Z

Name	Operator	Version
minio	eq	RELEASE.2021-11-03T03-36-36Z
minio	eq	RELEASE.2022-01-25T19-56-04Z
minio	eq	RELEASE.2021-02-24T18-44-45Z
minio	eq	RELEASE.2021-07-30T00-02-00Z
minio	eq	RELEASE.2021-06-17T00-10-46Z
minio	eq	RELEASE.2021-12-29T06-49-06Z
minio	eq	RELEASE.2023-01-20T02-05-44Z
minio	eq	RELEASE.2022-07-24T17-09-31Z
minio	eq	RELEASE.2021-03-04T00-53-13Z
minio	eq	RELEASE.2021-10-06T23-36-31Z

Rows per page:

1-10 of 1751

References

github.com/minio/minio/pull/16803

github.com/minio/minio/security/advisories/GHSA-9wfv-wmf7-6753

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

6.8 Medium

AI Score

Confidence

High

4.7 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:M/C:N/I:P/A:P

0.001 Low

EPSS

Percentile

29.5%

JSON

Related for OSV:CVE-2023-27589