CVE-2023-28433

HIGH

Minio <RELEASE.2023-03-20T20-16-18Z - Privilege Escalation

Title source: llm
STIX 2.1

Description

Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user. This issue is patched in RELEASE.2023-03-20T20-16-18Z. There are no known workarounds.

References (4)

Scores

CVSS v3 8.8
EPSS 0.0064
EPSS Percentile 70.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-668
Status published
Products (2)
minio/minio < 2023-03-20t20-16-18z
minio/minio 0 - 0.0.0-202303200735Go
Published Mar 22, 2023
Tracked Since Feb 18, 2026