What’s Vulnerable › Vulnerabilities

CVE-2023-28434: MinIO Security Feature Bypass Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2023-09-19
• EPSS: 7.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-03-22 · updated 2026-06-17
• Weakness: CWE-269

Description

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.

Affected products

• minio: before 2023-03-20t20-16-18z — fixed in 2023-03-20t20-16-18z

How to fix

Upgrade to a fixed version: minio 2023-03-20t20-16-18z. Check the vendor advisory for mitigations.

References

• https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5
• https://github.com/minio/minio/pull/16849
• https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c
• https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5
• https://github.com/minio/minio/pull/16849
• https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28434

Get alerted when CVE-2023-28434 or the next vulnerability affects your stack