{"id":"EUVD-2023-2395","enisaUuid":"410efb41-716d-30e9-80f7-5b981b871c8f","description":"Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER\u003doff`.","datePublished":"Mar 22, 2023, 8:44:04 PM","dateUpdated":"Oct 21, 2025, 11:15:22 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c\nhttps://github.com/minio/minio/pull/16849\nhttps://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5\n","aliases":"CVE-2023-28434\nGHSA-2pxw-r47w-4p8c\n","assigner":"GitHub_M","epss":7.92,"exploitedSince":"Sep 19, 2023, 12:00:00 AM","enisaIdProduct":[{"id":"4ba16fb3-ae20-3f93-8493-6b3e98f571ce","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"\u003c RELEASE.2023-03-20T20-16-18Z"}],"enisaIdVendor":[{"id":"9ca395c9-0e1f-3536-abf4-a61bad97a2aa","vendor":{"name":"minio"}}],"enisaIdVulnerability":[{"id":"3601c37b-fa9a-3d5d-b8cd-7cb536ce9e6f","vulnerability":{"id":"CVE-2023-28434","description":"Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER\u003doff`.","datePublished":"Mar 22, 2023, 8:44:04 PM","dateUpdated":"Oct 21, 2025, 11:15:22 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c\nhttps://github.com/minio/minio/pull/16849\nhttps://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5\n","enisa_id":"EUVD-2023-2395\n","assigner":"GitHub_M","epss":7.92,"dataProcessed":"Oct 30, 2026, 7:19:27 AM","exploitedSince":"Sep 19, 2023, 12:00:00 AM","vulnerabilityProduct":[{"id":"56c3b320-7cc5-3cce-9a25-a9128b65b361","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"\u003c RELEASE.2023-03-20T20-16-18Z"}],"vulnerabilityVendor":[{"id":"51b97f2e-973d-38f2-b78c-de2318238a64","vendor":{"name":"minio"}}]}},{"id":"6d295d79-c87e-30d1-878b-2270c19b638a","vulnerability":{"id":"GHSA-2pxw-r47w-4p8c","description":"Privilege Escalation on Linux/MacOS","datePublished":"Sep 5, 2023, 3:45:10 PM","dateUpdated":"Oct 22, 2025, 7:20:02 PM","baseScore":0.0,"references":"https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-28434\nhttps://github.com/minio/minio/pull/16849\nhttps://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5\nhttps://github.com/minio/minio\nhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve\u003dCVE-2023-28434\n","enisa_id":"EUVD-2023-2395\n","aliases":"CVE-2023-28434\nGHSA-2pxw-r47w-4p8c\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:48:02 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"ef7666b7-6b74-33b8-9a77-efc3ccc7fd7e","advisory":{"id":"WID-SEC-W-2023-2261","description":"MinIO: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen","summary":"Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MinIO ausnutzen, um Informationen offenzulegen.","datePublished":"Sep 4, 2023, 10:00:00 PM","dateUpdated":"Sep 4, 2023, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2261.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2023-2261\n","aliases":"CVE-2023-28434\nCVE-2023-28432\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"813ec840-4af9-3698-bb46-47ae7eb836ff","product":{"name":"Open Source MinIO \u003c RELEASE.2023-03-20T20-16-18Z","vendor":{"name":"open source"}}}]}}]}