{"id":"EUVD-2024-3532","enisaUuid":"e85ac13b-e9cf-321f-a4b4-3cd23d54e3b9","description":"MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in commit `f246c9053f9603e610d98439799bdd2a6b293427` which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately.","datePublished":"Dec 16, 2024, 8:02:00 PM","dateUpdated":"Dec 16, 2024, 8:18:46 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/minio/minio/security/advisories/GHSA-cwq8-g58r-32hg\nhttps://github.com/minio/minio/pull/20756\nhttps://github.com/minio/minio/commit/580d9db85e04f1b63cc2909af50f0ed08afa965f\nhttps://github.com/minio/minio/commit/f246c9053f9603e610d98439799bdd2a6b293427\n","aliases":"CVE-2024-55949\nGHSA-cwq8-g58r-32hg\n","assigner":"GitHub_M","epss":0.61,"enisaIdProduct":[{"id":"fb138dad-a262-3f70-b04f-bd425b27c72f","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"RELEASE.2022-06-25T15-50-16Z, \u003c RELEASE.2024-12-13T22-19-12Z"}],"enisaIdVendor":[{"id":"4127f53f-1603-37e5-9aa5-2b8d65c6e491","vendor":{"name":"minio"}}],"enisaIdVulnerability":[{"id":"a864e504-1c57-39af-a7a3-59b03c38d52b","vulnerability":{"id":"CVE-2024-55949","description":"MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in commit `f246c9053f9603e610d98439799bdd2a6b293427` which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately.","datePublished":"Dec 16, 2024, 8:02:00 PM","dateUpdated":"Dec 16, 2024, 8:18:46 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/minio/minio/security/advisories/GHSA-cwq8-g58r-32hg\nhttps://github.com/minio/minio/pull/20756\nhttps://github.com/minio/minio/commit/580d9db85e04f1b63cc2909af50f0ed08afa965f\nhttps://github.com/minio/minio/commit/f246c9053f9603e610d98439799bdd2a6b293427\n","enisa_id":"EUVD-2024-3532\n","assigner":"GitHub_M","epss":0.61,"dataProcessed":"Oct 27, 2026, 7:19:16 AM","vulnerabilityProduct":[{"id":"e823afdd-2049-3383-9b0b-08128d955fca","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"RELEASE.2022-06-25T15-50-16Z, \u003c RELEASE.2024-12-13T22-19-12Z"},{"id":"ed1be447-fc56-4e6b-a704-5e4c351a8f94","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"RELEASE.2022-06-25T15-50-16Z, \u003c RELEASE.2024-12-13T22-19-12Z"}],"vulnerabilityVendor":[{"id":"fad2a198-784b-33f2-b909-27f025f12387","vendor":{"name":"minio"}}]}},{"id":"e27c048a-fbe8-32f7-be60-d48dd4715363","vulnerability":{"id":"GHSA-cwq8-g58r-32hg","description":"MinIO vulnerable to privilege escalation in IAM import API","datePublished":"Dec 16, 2024, 5:27:53 PM","dateUpdated":"Dec 20, 2024, 2:09:31 PM","baseScore":null,"references":"https://github.com/minio/minio/security/advisories/GHSA-cwq8-g58r-32hg\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-55949\nhttps://github.com/minio/minio/pull/20756\nhttps://github.com/minio/minio/commit/580d9db85e04f1b63cc2909af50f0ed08afa965f\nhttps://github.com/minio/minio/commit/f246c9053f9603e610d98439799bdd2a6b293427\nhttps://github.com/minio/minio\n","enisa_id":"EUVD-2024-3532\n","aliases":"CVE-2024-55949\nGHSA-cwq8-g58r-32hg\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:10:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"9f608fdc-73c5-3c34-a5e8-c486c14a7310","advisory":{"id":"WID-SEC-W-2024-3706","description":"MinIO: Schwachstelle ermöglicht Privilegieneskalation","summary":"Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in MinIO ausnutzen, um seine Privilegien zu erhöhen.","datePublished":"Dec 16, 2024, 11:00:00 PM","dateUpdated":"Dec 22, 2024, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3706.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2024-3706\n","aliases":"CVE-2024-55949\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"55badfb5-cff7-3a9d-9c64-aa1230054510","product":{"name":"minio","vendor":{"name":"minio"}}},{"id":"8f1bfb10-ec15-3b78-83c7-cc21d0b0e2b0","product":{"name":"SUSE openSUSE","vendor":{"name":"SUSE"}}},{"id":"d57e77ff-ce60-35e7-826a-472d206dc964","product":{"name":"0.0.0-20241213221912-68b004a48f41","vendor":{"name":"open source"}}}]}},{"id":"a09f4929-5ae0-3f4f-83b0-788e0f7fafa1","advisory":{"id":"openSUSE-SU-2024:14603-1","description":"govulncheck-vulndb-0.0.20241218T202206-1.1 on GA media","summary":"govulncheck-vulndb-0.0.20241218T202206-1.1 on GA media","datePublished":"Dec 19, 2024, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:23:03 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_14603-1.json\nhttps://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GN5BTYONDVDULOG3YURKUJNL2YZ2LDHU/\nhttps://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GN5BTYONDVDULOG3YURKUJNL2YZ2LDHU/\nhttps://www.suse.com/security/cve/CVE-2024-12289/\nhttps://www.suse.com/security/cve/CVE-2024-28053/\nhttps://www.suse.com/security/cve/CVE-2024-45338/\nhttps://www.suse.com/security/cve/CVE-2024-48872/\nhttps://www.suse.com/security/cve/CVE-2024-54083/\nhttps://www.suse.com/security/cve/CVE-2024-54682/\nhttps://www.suse.com/security/cve/CVE-2024-55885/\nhttps://www.suse.com/security/cve/CVE-2024-55949/\n","aliases":"CVE-2024-12289\nCVE-2024-28053\nCVE-2024-45338\nCVE-2024-48872\nCVE-2024-54083\nCVE-2024-54682\nCVE-2024-55885\nCVE-2024-55949\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"0953961b-dd8e-3e7e-9326-788a88d9bd9d","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"111d680c-a5dc-362e-9245-03a40953c5a4","product":{"name":"govulncheck-vulndb-0:0.0.20241218T202206-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"a114ca25-4ce4-31ec-b56b-3a893b016bc0","product":{"name":"govulncheck-vulndb-0:0.0.20241218T202206-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"e3e7e620-c1ea-3d99-b2ff-d172875468c4","product":{"name":"govulncheck-vulndb-0:0.0.20241218T202206-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"f561ca98-7d4f-3fca-8a80-15370540d669","product":{"name":"govulncheck-vulndb-0:0.0.20241218T202206-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}}]}