Home / CVEs

Exploited vulnerabilities (CISA KEV)

CVEs with exploitation confirmed by CISA (Known Exploited Vulnerabilities), with required actions and deadlines.

2 result(s)

Export this search: RSS · CSV · STIX

CVE-2023-28432 High · 7.5 KEV Urgent · 79 Public exploit CWE-200 Mar 22, 2023

MinIO Information Disclosure Vulnerability

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

CVE-2023-28434 High · 8.8 KEV High · 61 Public exploit CWE-269 Mar 22, 2023

MinIO Security Feature Bypass Vulnerability

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.