CVE-2023-33955 Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited

Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0...

MinIO 安全漏洞

MinIO is an open source object storage server from US-based MinIO. The product supports building infrastructures for machine learning, analytics, and application data workloads. A security vulnerability exists in Minio Console versions prior to 0.28.0 that stems from Unicode RIGHT-TO-LEFT OVERRID...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Minio

CVE-2023-28432-metasploit-scanner MinIO Information Disclosure...

Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited

Impact Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. Reported-By Thanks to the report from Mio Li [email protected] Patches commit 17e791afb90c9ad27c65f63c6be14f2f6a3a9d60 Author: Daniel Valdivia Date: Tue May 23 08:47:12 2023 -0700 Replace RIGHT-TO-LEFT...

GHSA-JV3F-7M33-QP65 Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited

Impact Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. Reported-By Thanks to the report from Mio Li [email protected] Patches commit 17e791afb90c9ad27c65f63c6be14f2f6a3a9d60 Author: Daniel Valdivia Date: Tue May 23 08:47:12 2023 -0700 Replace RIGHT-TO-LEFT...

PT-2023-24595 · Minio · Minio Console

Name of the Vulnerable Software and Affected Versions: Minio Console versions prior to 0.28.0 Description: The issue allows Unicode RIGHT-TO-LEFT OVERRIDE characters to be used to mask the original filename. This can potentially lead to misleading or hidden file information. Recommendations: For...

MinIO Installed (Windows)

Binary data miniowininstalled.nbin...

MinIO Installed (Linux)

Binary data minioinstalledlinux.nbin...

MinIO Information Disclosure

MinIO is a multi-cloud and open-source object storage framework. When deployed in cluster mode, MinIO versions starting with RELEASE.2021-08-31T05-46-54Z and prior to RELEASE.2023-0320T20-16-18Z suffer from an information disclosure vulnerability, exposing all environment variables, including...

CISA Adds 3 Actively Exploited Flaws to KEV Catalog, including Critical PaperCut Bug

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday added three security flaws to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The three vulnerabilities are as follows - CVE-2023-28432 CVSS score - 7.5 - MinIO Information Disclosu...

CISA Adds 3 Actively Exploited Flaws to KEV Catalog, including Critical PaperCut Bug

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday added three security flaws to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The three vulnerabilities are as follows - CVE-2023-28432 CVSS score - 7.5 - MinIO Information Disclosu...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-28432 MinIO Information Disclosure Vulnerability CVE-2023-27350 PaperCut MF/NG Improper Access Control Vulnerability CVE-2023-2136 Google Chrome Skia Integer...

MinIO Information Disclosure Vulnerability

MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure...

The vulnerability of the MinIO object storage server, related to insecure management of privileges, allows an attacker to disable access to the root account’s credentials.

The vulnerability of the MinIO object storage server relates to a user with administrator privileges in the console. This user can potentially create another user that matches the root access credentials. Once this user is successfully created, the root account’s credentials will no longer functi...

The vulnerability of the MinIO object storage server arises from the exposure of all environment variables, including “MINIO_SECRET_KEY” and “MINIO_ROOT_PASSWORD”, which allow attackers to expose the protected information.

The vulnerability of the MinIO object storage server lies in the fact that all environment variables, including “MINIOSECRETKEY” and “MINIOROOTPASSWORD”, are returned. Exploiting this vulnerability allows a malicious actor to expose the protected information...

Exploit for Incorrect Authorization in Minio

PoC exploit for CVE-2021-43858, a vulnerability in MinIO. The ta...

ROS-20230411-03

The Minio object store vulnerability is related to a user with console administrator privileges who could potentially create a user that matches the root access key, once this user is successfully created, root credentials will stop working properly. Exploitation of the of the vulnerability could...

The vulnerability of the MinIO object storage server is related to errors during permission saving, which allow a malicious actor to delete managed objects.

The vulnerability of the MinIO object storage server is related to errors during permission saving. Exploiting this vulnerability could allow an attacker to delete managed objects...

Information Exposure

github.com/minio/minio-go, is vulnerable to Sensitive Information Exposure. The vulnerability exists during cluster deployment due to a lack of sensitive environment variable masking in the MINIOSECRETKEY and MINIOROOTPASSWORD, allowing an attacker to exfiltrate sensitive tokens from the system...

Privilege Escalation

github.com/minio/minio is vulnerable to Privilege Escalation. An attacker is able to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To achieve this, the attacker needs credentials with arn:aws:s3::: permission and...