Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
freebsdFreeBSDA4FF3673-D742-4B83-8C2B-3DDAFE732034
HistoryDec 27, 2021 - 12:00 a.m.

minio -- User privilege escalation

2021-12-2700:00:00
vuxml.freebsd.org
19
minio
user privilege
api endpoint
legacy behavior
http api
higher privileges
unix

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

50.8%

JSON

minio developers report:

AddUser() API endpoint was exposed to a legacy behavior. i.e it accepts a “policy” field
This API is mainly used to create a user or update a user’s password.
However, a malicious client can hand-craft an HTTP API call that allows for updating Policy for a user and gaining higher privileges.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchminio< 2021.12.27.07.23.18UNKNOWN

Related

githubexploit 3
cnvd 1
redhatcve 1
osv 3
cvelist 1
prion 1
nessus 1
cve 1
alpinelinux 1
nvd 1
ibm 1
redhat 2
githubexploit
githubexploit
Exploit for Improper Privilege Management in Minio
2022-01-03 17:11:54
Exploit for CVE-2021-43858
2022-01-03 14:12:35
Exploit for Improper Privilege Management in Minio
2023-04-12 07:34:03
cnvd
cnvd
Minio MinIO has an unspecified vulnerability
2021-12-29 00:00:00
redhatcve
redhatcve
CVE-2021-43858
2021-12-30 18:21:52
osv
osv
BIT-minio-2021-43858
2024-03-06 10:57:38
CGA-9hv4-3f9m-g6pg
2024-06-06 12:25:27
CVE-2021-43858
2021-12-27 22:15:07
cvelist
cvelist
CVE-2021-43858 User privilege escalation in MinIO
2021-12-27 21:20:11
prion
prion
Design/Logic Flaw
2021-12-27 22:15:00
nessus
nessus
FreeBSD : minio -- User privilege escalation (a4ff3673-d742-4b83-8c2b-3ddafe732034)
2021-12-29 00:00:00
cve
cve
CVE-2021-43858
2021-12-27 22:15:07
alpinelinux
alpinelinux
CVE-2021-43858
2021-12-27 22:15:07
nvd
nvd
CVE-2021-43858
2021-12-27 22:15:07
ibm
ibm
Security Bulletin: Vulnerabilities in Golang Go, MinIO, and Python may affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and OpenShift
2022-01-31 19:17:37
redhat
redhat
(RHSA-2022:0735) Important: Red Hat Advanced Cluster Management 2.4.2 security updates and bug fixes
2022-03-03 01:33:59
(RHSA-2022:4956) Important: Red Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes
2022-06-08 12:06:26

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

50.8%

JSON
Related for A4FF3673-D742-4B83-8C2B-3DDAFE732034
githubexploit3cnvd1redhatcve1osv3cvelist1prion1nessus1cve1alpinelinux1nvd1ibm1redhat2