CVE-2023-27589

Published: Mar 14, 2023Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Exploitability: 1.2 / Impact: 5.2

Source: NVD

Description

Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with `consoleAdmin` permissions can potentially create a user that matches the root credential `accessKey`. Once this user is created successfully, the root credential ceases to work appropriately. The issue is patched in RELEASE.2023-03-13T19-46-17Z. There are ways to work around this via adding higher privileges to the disabled root user via `mc admin policy set`.

Affected (1)

Products: Minio: Minio

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Minio Minio	From 2020-12-23t02-24-12z to 2023-03-13t19-46-17z

Related CWEs

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (4)

https://github.com/minio/minio/pull/16803

Source: security-advisories@github.com

ExploitPatch

https://github.com/minio/minio/security/advisories/GHSA-9wfv-wmf7-6753

Source: security-advisories@github.com

Vendor Advisory

https://github.com/minio/minio/pull/16803

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://github.com/minio/minio/security/advisories/GHSA-9wfv-wmf7-6753

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.