Published: 08/03/2021 Updated: 21/10/2022

CVSS v2 Base Score: 4 | Impact Score: 2.9 | Exploitability Score: 8

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 356

Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who uses MinIO multi-users. This is fixed in version RELEASE.2021-03-04T00-53-13Z. As a workaround, one can disable uploads with `Content-Type: multipart/form-data` as mentioned in the S3 API RESTObjectPOST docs by using a proxy in front of MinIO.

Vulnerable Product	Search on Vulmon	Subscribe to Product
minio minio

In MinIO before version RELEASE2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL Everyone is impacted who uses MinIO multi-users This is fixed in version RELEASE2021-03-04T00-53-13Z As a workaround, one can disable uploads with `Content-Type: multipart/form-data` as mentioned in the S ...

CWE-863 https://github.com/minio/minio/commit/039f59b552319fcc2f83631bb421a7d4b82bc482 https://github.com/minio/minio/pull/11682 https://github.com/minio/minio/security/advisories/GHSA-hq5j-6r98-9m8v https://github.com/minio/minio/releases/tag/RELEASE.2021-03-04T00-53-13Z https://nvd.nist.gov https://security.archlinux.org/CVE-2021-21362

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2021-21362

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect