{"revision":"e46406c4032149f39463ccf74dcc176c","evidence":{"cve":"CVE-2023-28434","kev":{"cve":"CVE-2023-28434","product":"MinIO","name":"MinIO Security Feature Bypass Vulnerability","dateAdded":"2023-09-19","dueDate":"2023-10-10","knownRansomwareUse":false,"shortDescription":"MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.","vendor":"MinIO","isMicrosoft":false,"products":[],"advisoryUrl":"https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c","publicExploit":null,"msrcUrl":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28434","cisaUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28434"},"epss":null,"observedAt":"2026-10-23T16:01:26.7735792+00:00","kevRetained":false,"reviewIdentity":"463f2bfc56da85d5aa77dad0"}}