CVE-2020-11012
Critical
Description
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.
SeverityCritical
CVSS9.3
Exploit probability—
Product
Minio
PublishedApr 23, 2020
First seenApr 23, 2020
Weakness typeCWE-305CWE-305
How to fix
Update
- minio minio2020-04-23t00-58-49z or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| minio minio | v < 2020-04-23t00-58-49z | 2020-04-23t00-58-49z |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.