Vulnerability identifier: #VU64785

Vulnerability risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-24842

CWE-ID: CWE-269

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
minio
Other software / Other software solutions

Vendor: minio.io

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to improper privilege management. A remote non-admin user can create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

minio: 2021-12-09T06-19-41Z - 2022-04-09T15-09-52Z

---

External links
http://github.com/minio/minio/security/advisories/GHSA-2j69-jjmg-534q
http://github.com/minio/minio/commit/66b14a0d32684d527ae8018dc6d9d46ccce58ae3
http://github.com/minio/minio/pull/14729

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.