ZeroDay Findings
Sign inSign up

Findings

CVE-2023-28434

MinIO Security Feature Bypass Vulnerability

Published Mar 22, 2023 · updated Jun 16, 2026 · minio minio

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing . To carry out this attack, the attacker requires credentials with permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off .

Timeline

Detection, updates, and resolution for this record.

  1. Mar 22, 2023 · Catalog

    Detected

    Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing . To carry out this attack, the attacker requires credentials with permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a

  2. Sep 19, 2023 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Oct 10, 2023 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing . To carry out this attack, the attacker requires credentials with permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Oct 10, 2023

Affected

  • cpe minio/minioversion unspecified
  • vendor MinIO MinIOversion unspecified

Sources

  • CISA KEVCVE-2023-28434

    MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing to conduct privilege escalation. To carry out this attack, the attacker requires credentials with permission, as well as enabled Console API access.

    cisa.gov
  • CVE.orgCVE-2023-28434

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-28434

    30-day exploitation probability 7.9%

    first.org
  • NIST NVDCVE-2023-28434

    Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing . To carry out this attack, the attacker requi

    nvd.nist.gov

References