Vulnerability in Minio
CVE-2020-11012
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.
EPSS: 0.021 (79.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N.
Affected products
- Minio — versions < RELEASE.2020-04-23T00-58-49Z
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-11012?
- CVE-2020-11012 is a critical-severity vulnerability in Minio, classified under Authentication Bypass by Primary Weakness. CVSS score: 9.3/10. Published 2020-04-23.
- How severe is CVE-2020-11012?
- Critical severity. CVSS v3 base score is 9.3 out of 10.
- Is CVE-2020-11012 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.