Improper Privilege Management

2024-02-2817:13:49

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

minio

vulnerability

improper access control

access key hierarchy

privilege escalation

admin rights

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.002

Percentile

59.1%

JSON

MinIO is vulnerable to Improper Privilege Management. The vulnerability is caused due to an improper access control checks where the access key hierarchy in MinIO allows the creation of access keys that inherit permissions from the parent key, enabling the override of s3 permissions, including admin rights.This can potentially leads to privilege escalation.