{"id":"EUVD-2025-9731","enisaUuid":"50f1b8ec-8d46-3367-806e-2f15c583ec81","description":"MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access\nto - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z.","datePublished":"Apr 3, 2025, 7:36:09 PM","dateUpdated":"Apr 3, 2025, 8:36:19 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh\nhttps://github.com/minio/minio/pull/21103\n","aliases":"CVE-2025-31489\nGHSA-wg47-6jq2-q2hh\n","assigner":"GitHub_M","epss":2.52,"enisaIdProduct":[{"id":"f11e6f79-2a6d-37fc-bf4d-21932005b456","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"\u003c RELEASE.2025-04-03T14-56-28Z"}],"enisaIdVendor":[{"id":"3a5a8a4e-d0f5-3813-839c-332bfa537c42","vendor":{"name":"minio"}}],"enisaIdVulnerability":[{"id":"48b4003c-098d-31b6-b8c5-31559610331f","vulnerability":{"id":"CVE-2025-31489","description":"MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access\nto - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z.","datePublished":"Apr 3, 2025, 7:36:09 PM","dateUpdated":"Apr 3, 2025, 8:36:19 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh\nhttps://github.com/minio/minio/pull/21103\n","enisa_id":"EUVD-2025-9731\n","assigner":"GitHub_M","epss":2.52,"dataProcessed":"Nov 2, 2026, 7:14:50 AM","vulnerabilityProduct":[{"id":"919bf7c3-524d-48c4-97a2-d3d1e0181683","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"\u003c RELEASE.2025-04-03T14-56-28Z"},{"id":"c86c0831-45eb-3b42-b22e-49c074e09c33","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"\u003c RELEASE.2025-04-03T14-56-28Z"}],"vulnerabilityVendor":[{"id":"99b641ea-2660-347c-9e71-139a80017112","vendor":{"name":"minio"}}]}},{"id":"c98c67a6-5001-3da4-ade7-bc025b371286","vulnerability":{"id":"GHSA-wg47-6jq2-q2hh","description":"MinIO performs incomplete signature validation for unsigned-trailer uploads","datePublished":"Apr 4, 2025, 2:28:29 PM","dateUpdated":"Apr 4, 2025, 2:28:29 PM","baseScore":0.0,"references":"https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-31489\nhttps://github.com/minio/minio/pull/21103\nhttps://github.com/minio/minio/commit/8c70975283f9f4ce80f331a25c7475a36279e519\nhttps://github.com/minio/minio\n","enisa_id":"EUVD-2025-9731\n","aliases":"CVE-2025-31489\nGHSA-wg47-6jq2-q2hh\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:11:32 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"21772cf2-20fd-3b13-9838-2c7971bd1bb6","advisory":{"id":"openSUSE-SU-2025:14982-1","description":"govulncheck-vulndb-0.0.20250409T170536-1.1 on GA media","summary":"govulncheck-vulndb-0.0.20250409T170536-1.1 on GA media","datePublished":"Apr 10, 2025, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:30:57 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_14982-1.json\nhttps://www.suse.com/security/cve/CVE-2025-31483/\nhttps://www.suse.com/security/cve/CVE-2025-31489/\nhttps://www.suse.com/security/cve/CVE-2025-32024/\nhttps://www.suse.com/security/cve/CVE-2025-32025/\n","aliases":"CVE-2025-31483\nCVE-2025-31489\nCVE-2025-32024\nCVE-2025-32025\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"05fd9af0-9edf-3b1a-9f54-c0d5c492470c","product":{"name":"govulncheck-vulndb-0:0.0.20250409T170536-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"0c57feb3-741e-380a-9352-b4bd5dff43ff","product":{"name":"govulncheck-vulndb-0.0.20250409T170536-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"26d26ea1-0ade-3d84-a215-290e652ab793","product":{"name":"govulncheck-vulndb-0:0.0.20250409T170536-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"4e1f2efd-0c3f-35cc-aa00-8874d9b3a040","product":{"name":"govulncheck-vulndb-0.0.20250409T170536-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"69f2e46d-87f6-3f69-9c4e-07a2d0a83eb9","product":{"name":"govulncheck-vulndb-0.0.20250409T170536-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"8b3e5dad-8caa-3532-8ac1-a9fa23327df8","product":{"name":"govulncheck-vulndb-0.0.20250409T170536-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"8c2b36fd-dfdc-3798-890a-4f72ea2c5bd0","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"b8594578-f42f-395a-9409-e88f8d79376a","product":{"name":"govulncheck-vulndb-0:0.0.20250409T170536-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"b8c7afb3-c66c-385d-be0e-27bb5c519aa5","product":{"name":"govulncheck-vulndb-0:0.0.20250409T170536-1.1.x86_64","vendor":{"name":"SUSE"}}}]}},{"id":"94149e19-3771-3460-bcc5-734a4f160590","advisory":{"id":"WID-SEC-W-2025-0714","description":"MinIO: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen","summary":"Ein Angreifer kann eine Schwachstelle in MinIO ausnutzen, um Sicherheitsvorkehrungen zu umgehen.","datePublished":"Apr 6, 2025, 10:00:00 PM","dateUpdated":"Apr 6, 2025, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0714.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2025-0714\n","aliases":"CVE-2025-31489\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"3547b5b2-18ca-372a-baf1-b6690152b933","product":{"name":"minio","vendor":{"name":"minio"}}},{"id":"41214dbc-2b73-3e45-9ebd-0b4111c3cd94","product":{"name":"Open Source MinIO \u003c0.0.0-20250403145552-8c70975283f9","vendor":{"name":"open source"}}}]}}]}