{"id":"EUVD-2024-0775","enisaUuid":"d07724d5-8a74-3a3c-bb66-96c882675db8","description":"MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.","datePublished":"Jan 31, 2024, 10:10:23 PM","dateUpdated":"Aug 1, 2024, 11:28:11 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/minio/minio/security/advisories/GHSA-xx8w-mq23-29g4\nhttps://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776\nhttps://github.com/minio/minio/releases/tag/RELEASE.2024-01-31T20-20-33Z\n","aliases":"CVE-2024-24747\nGHSA-xx8w-mq23-29g4\n","assigner":"GitHub_M","epss":34.09,"enisaIdProduct":[{"id":"0298e3b4-f517-353d-b27f-f201480fcc92","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"\u003c RELEASE.2024-01-31T20-20-33Z"},{"id":"d323465c-6ec0-3502-bd76-fad8b431350f","product":{"name":"minio","vendor":{"name":"minio"}}}],"enisaIdVendor":[{"id":"d323465c-6ec0-3502-bd76-fad8b431350f","vendor":{"name":"minio"}}],"enisaIdVulnerability":[{"id":"0760f6c3-b29e-33e2-a223-ed275fa5d796","vulnerability":{"id":"CVE-2024-24747","description":"MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.","datePublished":"Jan 31, 2024, 10:10:23 PM","dateUpdated":"Aug 1, 2024, 11:28:11 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/minio/minio/security/advisories/GHSA-xx8w-mq23-29g4\nhttps://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776\nhttps://github.com/minio/minio/releases/tag/RELEASE.2024-01-31T20-20-33Z\n","enisa_id":"EUVD-2024-0775\n","assigner":"GitHub_M","epss":34.09,"dataProcessed":"Nov 10, 2026, 7:41:53 AM","vulnerabilityProduct":[{"id":"93020375-07d2-3ec0-bfa0-acdf1514c505","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"\u003c RELEASE.2024-01-31T20-20-33Z"},{"id":"b60e798a-757e-4234-9f67-38f5b1570d96","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"\u003c RELEASE.2024-01-31T20-20-33Z"}],"vulnerabilityVendor":[{"id":"e025646b-ab06-333b-a714-d6a569ea58bb","vendor":{"name":"minio"}}]}},{"id":"b0b286ef-890d-3071-92ad-e0a782f2c0bd","vulnerability":{"id":"GHSA-xx8w-mq23-29g4","description":"Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation","datePublished":"Feb 1, 2024, 7:21:30 PM","dateUpdated":"Feb 1, 2024, 10:52:18 PM","baseScore":null,"references":"https://github.com/minio/minio/security/advisories/GHSA-xx8w-mq23-29g4\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-24747\nhttps://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776\nhttps://github.com/minio/minio\nhttps://github.com/minio/minio/releases/tag/RELEASE.2024-01-31T20-20-33Z\n","enisa_id":"EUVD-2024-0775\n","aliases":"CVE-2024-24747\nGHSA-xx8w-mq23-29g4\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:33:48 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}