CVE-2023-25812

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-25812
Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Governance-Retention: true`. However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted. All users are advised to upgrade. There are no known workarounds for this issue.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/minio/minio/commit/a7188bc9d0f0a5ae05aaf1b8126bcd3cb3fdc485 Patch
https://github.com/minio/minio/pull/16635 Issue Tracking Patch
https://github.com/minio/minio/security/advisories/GHSA-c8fc-mjj8-fc63 Exploit Vendor Advisory
https://github.com/minio/minio/commit/a7188bc9d0f0a5ae05aaf1b8126bcd3cb3fdc485 Patch
https://github.com/minio/minio/pull/16635 Issue Tracking Patch
https://github.com/minio/minio/security/advisories/GHSA-c8fc-mjj8-fc63 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:50

Type Values Removed Values Added
Summary
  • (es) Minio es un framework de almacenamiento de objetos Multi-Cloud. Las versiones afectadas no respetan correctamente la política "Denegar" en ByPassGoverance. Idealmente, minio debería devolver "Acceso denegado" a todos los usuarios que intenten ELIMINAR un ID de versión con el encabezado especial "X-Amz-Bypass-Governance-Retention: true". Sin embargo, esto no se cumplió; en cambio, la solicitud se aceptará y un objeto bajo control se eliminará incorrectamente. Se recomienda a todos los usuarios que actualicen. No se conocen workarounds para este problema.
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 6.5
References () https://github.com/minio/minio/commit/a7188bc9d0f0a5ae05aaf1b8126bcd3cb3fdc485 - Patch () https://github.com/minio/minio/commit/a7188bc9d0f0a5ae05aaf1b8126bcd3cb3fdc485 - Patch
References () https://github.com/minio/minio/pull/16635 - Issue Tracking, Patch () https://github.com/minio/minio/pull/16635 - Issue Tracking, Patch
References () https://github.com/minio/minio/security/advisories/GHSA-c8fc-mjj8-fc63 - Exploit, Vendor Advisory () https://github.com/minio/minio/security/advisories/GHSA-c8fc-mjj8-fc63 - Exploit, Vendor Advisory

07 Nov 2023, 04:09

Type Values Removed Values Added
Summary Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Governance-Retention: true`. However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted. All users are advised to upgrade. There are no known workarounds for this issue. Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Governance-Retention: true`. However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted. All users are advised to upgrade. There are no known workarounds for this issue.
Information

Published : 2023-02-21 21:15

Updated : 2024-11-21 07:50

NVD link : CVE-2023-25812

Mitre link : CVE-2023-25812

CVE.ORG link : CVE-2023-25812

JSON object : View

Products Affected

minio

  • minio
CWE
CWE-281

Improper Preservation of Permissions

NVD-CWE-noinfo