CVE-2024-24747

Published: Jan 31, 2024Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.

Affected (1)

Products: Minio: Minio

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Minio Minio	Version 2024-01-31t20-20-33z

Related CWEs

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (6)

https://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776

Source: security-advisories@github.com

Patch

https://github.com/minio/minio/releases/tag/RELEASE.2024-01-31T20-20-33Z

Source: security-advisories@github.com

PatchRelease Notes

https://github.com/minio/minio/security/advisories/GHSA-xx8w-mq23-29g4

Source: security-advisories@github.com

ExploitPatchVendor Advisory

https://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/minio/minio/releases/tag/RELEASE.2024-01-31T20-20-33Z

Source: af854a3a-2127-422b-91ae-364da2661108

PatchRelease Notes

https://github.com/minio/minio/security/advisories/GHSA-xx8w-mq23-29g4

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchVendor Advisory

Timeline

No history available yet.