Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2022-24842 |
CWE-ID | CWE-269 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
minio Other software / Other software solutions |
Vendor | minio.io |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU64785
Risk: Medium
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-24842
CWE-ID:
CWE-269 - Improper Privilege Management
Exploit availability: No
DescriptionThe vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to improper privilege management. A remote non-admin user can create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials.
MitigationInstall updates from vendor's website.
Vulnerable software versionsminio: 2021-12-09T06-19-41Z - 2022-04-09T15-09-52Z
External linkshttp://github.com/minio/minio/security/advisories/GHSA-2j69-jjmg-534q
http://github.com/minio/minio/commit/66b14a0d32684d527ae8018dc6d9d46ccce58ae3
http://github.com/minio/minio/pull/14729
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.