CVE-2023-28432: Minio Information Disclosure in Cluster Deployment
High · CVSS 7.5 (CVSS 3.1)KEV known exploitedEPSS 84.0%, 100th percentilePublished Updated Assigner: GitHub_M
In CISA’s Known Exploited Vulnerabilities catalog: MinIO Information Disclosure Vulnerability.
Added , federal remediation due . Known ransomware use: Unknown.
Required action: Apply updates per vendor instructions.
Description
Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · CWE-200
Status incidents that name it
No tracked status incident names this CVE.
Affected vendors and products
minio: minio
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z (opens in new tab)
- github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q (opens in new tab)
- twitter.com/Andrew___Morris/status/1639325397241278464 (opens in new tab)
- viz.greynoise.io/tag/minio-information-disclosure-attempt (opens in new tab)
- www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-ke… (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)