Lucene search
PRIOn knowledge basePRION:CVE-2023-27589HistoryMar 14, 2023 - 7:15 p.m.
Design/Logic Flaw
2023-03-1419:15:00
PRIOn knowledge base
www.prio-n.com
1
minio storage
multi-cloud object
security flaw
consoleadmin permissions
accesskey issue
patched
workaround
mc admin policy set
Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with consoleAdmin permissions can potentially create a user that matches the root credential accessKey. Once this user is created successfully, the root credential ceases to work appropriately. The issue is patched in RELEASE.2023-03-13T19-46-17Z. There are ways to work around this via adding higher privileges to the disabled root user via mc admin policy set.
| CPE | Name | Operator | Version |
|---|---|---|---|
| minio | eq | >= 20201223t22412z AND < 2023313t194617z |
Related
nvd
nvd
CVE-2023-27589
2023-03-14 19:15:10
veracode
veracode
Privilege Escalation
2023-03-15 01:47:07
cvelist
cvelist
cve
cve
CVE-2023-27589
2023-03-14 19:15:10
redos
redos
ROS-20230411-03
2023-04-11 00:00:00
osv
osv
BIT-minio-2023-27589
2024-03-06 10:56:49
CVE-2023-27589
2023-03-14 19:15:10
