PT-2020-12492 · Minio+1 · Minio+1

Harshavardhana · Published 2020-04-23 · Updated 2024-03-06 · CVE-2020-11012

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions MinIO versions prior to RELEASE.2020-04-23T00-58-49Z

Description The issue allows for an authentication bypass in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations, such as creating new service accounts for existing access keys, without knowing the admin secret key.

Recommendations For versions prior to RELEASE.2020-04-23T00-58-49Z, update to version RELEASE.2020-04-23T00-58-49Z or later to resolve the issue. As a temporary workaround, consider restricting access to the MinIO admin API to minimize the risk of exploitation.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-305

Related Identifiers

ALT-PU-2020-1889

BIT-MINIO-2020-11012

CVE-2020-11012

GHSA-XV4R-VCCV-MG4W

Affected Products

Alt Linux

Minio

References · 8

• https://github.com/minio/minio/security/advisories/GHSA-xv4r-vccv-mg4w · Patch
• https://github.com/minio/minio/commit/4cd6ca02c7957aeb2de3eede08b0754332a77923 · Patch
• https://osv.dev/vulnerability/CVE-2020-11012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11012 · Security Note
• https://osv.dev/vulnerability/BIT-minio-2020-11012 · Vendor Advisory
• https://github.com/minio/minio/releases/tag/RELEASE.2020-04-23T00-58-49Z · Note
• https://github.com/minio/minio/pull/9422 · Note
• https://t.me/cvenotify/3164 · Telegram Post