CVE-2023-28432

2023-03-2221:15:18

CWE-200

[email protected]

web.nvd.nist.gov

443

In Wild

minio

multi-cloud object storage

cve-2023-28432

information disclosure

environment variables

security vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.3 High

AI Score

Confidence

High

0.865 High

EPSS

Percentile

98.6%

JSON

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY
and MINIO_ROOT_PASSWORD, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

Affected configurations

Vulners

NVD

Node

miniominioRange2019-12-17T23-16-33Z–2023-03-20T20-16-18Z

VendorProductVersionCPE
miniominio*cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
minio	minio	*	cpe:2.3:a:minio:minio::::::::

CNA Affected

[
  {
    "vendor": "minio",
    "product": "minio",
    "versions": [
      {
        "version": ">= RELEASE.2019-12-17T23-16-33Z, < RELEASE.2023-03-20T20-16-18Z",
        "status": "affected"
      }
    ]
  }
]