Published: 27/12/2021 Updated: 09/08/2022

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 580

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.

Vulnerable Product	Search on Vulmon	Subscribe to Product
minio minio

Synopsis Important: Red Hat Advanced Cluster Management 25 security updates, images, and bug fixes Type/Severity Security Advisory: Important Topic Red Hat Advanced Cluster Management for Kubernetes 250 is now generally availableRed Hat Product Security has rated this update as having a security impactof Important A Common Vulnerability ...

Synopsis Important: Red Hat Advanced Cluster Management 242 security updates and bug fixes Type/Severity Security Advisory: Important Topic Red Hat Advanced Cluster Management for Kubernetes 242 General Availabilityrelease images This update provides security fixes, fixes bugs, and updates the container imagesRed Hat Product Security ha ...

MinIO is a Kubernetes native application for cloud storage Prior to version `RELEASE2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges The patch in version `RELEASE2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability t ...

Check Point Reference: CPAI-2021-2061 Date Published: 4 Dec 2023 Severity: High ...

CVE-2021-43858 MinIO exploit MinIO 用户权限提升漏洞(CVE-2021-43858) exp 运行方式：go run expgo ip port

CVE-2021-43858 exploit MinIO 用户权限提升漏洞 exp 运行方式：go run expgo

CWE-863 https://github.com/minio/minio/commit/5a96cbbeaabd0a82b0fe881378e7c21c85091abf https://github.com/minio/minio/releases/tag/RELEASE.2021-12-27T07-23-18Z https://github.com/minio/minio/pull/13976 https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cx https://github.com/minio/minio/pull/7949 https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2022:4956

CVE-2021-43858

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect