{"id":"EUVD-2023-2606","enisaUuid":"450ad01d-4778-37d6-bd6a-c9ed1083d369","description":"Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\\` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user. This issue is patched in RELEASE.2023-03-20T20-16-18Z. There are no known workarounds.","datePublished":"Mar 22, 2023, 8:33:43 PM","dateUpdated":"Feb 25, 2025, 2:51:18 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/minio/minio/security/advisories/GHSA-w23q-4hw3-2pp6\nhttps://github.com/minio/minio/commit/8d6558b23649f613414c8527b58973fbdfa4d1b8\nhttps://github.com/minio/minio/commit/b3c54ec81e0a06392abfb3a1ffcdc80c6fbf6ebc\nhttps://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z\n","aliases":"CVE-2023-28433\nGHSA-w23q-4hw3-2pp6\n","assigner":"GitHub_M","epss":0.98,"enisaIdProduct":[{"id":"fac32658-f481-3b29-ab52-98a538a6b01a","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"\u003c RELEASE.2023-03-20T20-16-18Z"}],"enisaIdVendor":[{"id":"59cfad50-fed5-3a24-ada2-640db876c49e","vendor":{"name":"minio"}}],"enisaIdVulnerability":[{"id":"155c0f45-6471-3212-8405-4401c1bd12bb","vulnerability":{"id":"CVE-2023-28433","description":"Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\\` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user. This issue is patched in RELEASE.2023-03-20T20-16-18Z. There are no known workarounds.","datePublished":"Mar 22, 2023, 8:33:43 PM","dateUpdated":"Feb 25, 2025, 2:51:18 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/minio/minio/security/advisories/GHSA-w23q-4hw3-2pp6\nhttps://github.com/minio/minio/commit/8d6558b23649f613414c8527b58973fbdfa4d1b8\nhttps://github.com/minio/minio/commit/b3c54ec81e0a06392abfb3a1ffcdc80c6fbf6ebc\nhttps://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z\n","enisa_id":"EUVD-2023-2606\n","assigner":"GitHub_M","epss":0.98,"dataProcessed":"Nov 3, 2026, 7:19:17 AM","vulnerabilityProduct":[{"id":"e0793273-30dc-414c-a017-7de55ad12aca","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"\u003c RELEASE.2023-03-20T20-16-18Z"},{"id":"f30275eb-1b31-3375-b368-26f34ef9a632","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"\u003c RELEASE.2023-03-20T20-16-18Z"}],"vulnerabilityVendor":[{"id":"be592a8f-fb2d-3d7a-8a6b-7f5217e3830c","vendor":{"name":"minio"}}]}},{"id":"afa96794-d853-32aa-b2f7-6091b8a88efa","vulnerability":{"id":"GHSA-w23q-4hw3-2pp6","description":"Minio vulnerable to Privilege Escalation on Windows via Path separator manipulation","datePublished":"Sep 6, 2023, 6:43:13 PM","dateUpdated":"Sep 6, 2023, 6:43:13 PM","baseScore":null,"references":"https://github.com/minio/minio/security/advisories/GHSA-w23q-4hw3-2pp6\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-28433\nhttps://github.com/minio/minio/commit/8d6558b23649f613414c8527b58973fbdfa4d1b8\nhttps://github.com/minio/minio/commit/b3c54ec81e0a06392abfb3a1ffcdc80c6fbf6ebc\nhttps://github.com/minio/minio\nhttps://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z\n","enisa_id":"EUVD-2023-2606\n","aliases":"CVE-2023-28433\nGHSA-w23q-4hw3-2pp6\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:07:20 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"9d742ff2-3d97-3e0e-891b-5c723cc83fd4","advisory":{"id":"WID-SEC-W-2023-2282","description":"MinIO: Schwachstelle ermöglicht Privilegieneskalation","summary":"Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in MinIO ausnutzen, um seine Privilegien zu erhöhen.","datePublished":"Sep 6, 2023, 10:00:00 PM","dateUpdated":"Sep 6, 2023, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2282.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2023-2282\n","aliases":"CVE-2023-28433\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"eba7f892-464d-3456-8f20-7ba2a6e8fc08","product":{"name":"Open Source MinIO \u003c 2023-03-20T20-16-18Z","vendor":{"name":"open source"}}}]}}]}