Risk | High |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2021-43858 |
CWE-ID | CWE-269 |
Exploitation vector | Network |
Public exploit | Public exploit code for vulnerability #1 is available. |
Vulnerable software Subscribe |
minio Other software / Other software solutions |
Vendor | minio.io |
Security Bulletin
This security bulletin contains one high risk vulnerability.
EUVDB-ID: #VU64694
Risk: High
CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2021-43858
CWE-ID:
CWE-269 - Improper Privilege Management
Exploit availability: Yes
DescriptionThe vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to improper privilege management in AddUser() function admin API. A remote user can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges.
MitigationInstall updates from vendor's website.
Vulnerable software versionsminio: 2021-01-05T05-22-38Z - 2021-12-20T22-07-16Z
External linkshttp://github.com/minio/minio/commit/5a96cbbeaabd0a82b0fe881378e7c21c85091abf
http://github.com/minio/minio/releases/tag/RELEASE.2021-12-27T07-23-18Z
http://github.com/minio/minio/pull/13976
http://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cx
http://github.com/minio/minio/pull/7949
http://bugzilla.redhat.com/show_bug.cgi?id=2036252
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.