CVE-2024-24747 MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation

MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for s3: actions, but also admin: actions. Which means unless somewhere above in the access-key hierarchy, the admin rights are denied, access keys will be able t...

CVE-2024-24747

MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for s3: actions, but also admin: actions. Which means unless somewhere above in the access-key hierarchy, the admin rights are denied, access keys will be able t...

CVE-2024-24747

CVE-2024-24747 (MinIO) : MinIO allows new access keys to inherit the parent’s permissions, including admin:*, enabling potential privilege escalation by overriding their own s3 permissions. The issue is mitigated in the release RELEASE.2024-01-31T20-20-33Z. Connected docs also describe related ad...

CVE-2024-24747 MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation

MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for s3: actions, but also admin: actions. Which means unless somewhere above in the access-key hierarchy, the admin rights are denied, access keys will be able t...

minio -- privilege escalation via permissions inheritance

Minio security advisory GHSA-xx8w-mq23-29g4 ports: When someone creates an access key, it inherits the permissions of the parent key. Not only for s3: actions, but also admin: actions. Which means unless somewhere above in the access-key hierarchy, the admin rights are denied, access keys will be...

MinIO 安全漏洞

MinIO is an open source object storage server from US-based MinIO. The product supports building infrastructures for machine learning, analytics, and application data workloads. MinIO has a security vulnerability. An attacker can gain higher privileges by exploiting the vulnerability...

PT-2024-1573 · Minio +2 · Minio +2

Name of the Vulnerable Software and Affected Versions: MinIO versions prior to RELEASE.2024-01-31T20-20-33Z Description: The issue is related to the inheritance of permissions by access keys in MinIO, a high-performance object storage system. When an access key is created, it inherits the...

MinIO Console Detection

Binary data minioconsoledetect.nbin...

MinIO Information Disclosure (CVE-2023-28432)

Binary data minioCVE-2023-28432.nbin...

VulnCheck KEV: CVE-2021-41266

Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. All users on release v0.12.2 and before are...

CVE-2024-21664 vulnerabilities

Vulnerabilities for packages: mc, tekton-chains, vexctl, gitsign, kubescape, spire-server, boring-registry, minio, falcoctl...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Minio

CVE-2023-28432 CVE-2023-28432 Minio Information isclosure Exp...

Exploit for Cross-site Scripting in Helpsystems Cobalt_Strike

Gui-poc-test A testing tool for CobaltStrike-RCE:CVE-2022-3919...

MinIO Installed (macOS)

Binary data miniomacinstalled.nbin...

The vulnerability of the MinIO object storage server, related to deficiencies in access control, allows a attacker to create a user with administrator privileges.

The vulnerability of the MinIO object storage server is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to create a user with administrator privileges...

GHSA-MR45-RX8Q-WCM9 vulnerabilities

Vulnerabilities for packages: k3s, nats, minio, nats-server...

GHSA-MR45-RX8Q-WCM9 vulnerabilities

Vulnerabilities for packages: nats, nats-server, k3s, minio...

CVE-2023-46129 vulnerabilities

Vulnerabilities for packages: k3s, nats, minio, nats-server...

CVE-2023-46129 vulnerabilities

Vulnerabilities for packages: nats, nats-server, k3s, minio...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: slsa-verifier, kubeflow, spark-operator, metrics-server-fips, vault-csi-provider, bank-vaults-fips, kubernetes-csi-livenessprobe, buildkitd, scorecard, prometheus-blackbox-exporter, timestamp-authority-fips, kubevela, kubescape, prometheus-stackdriver-exporter, corte...