CVE-2021-41137

Katalog CVE

CVSS 8.8 · High EPSS 1,3%

Kerentanan Improper Authorization pada minio. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerability that involves bypassing policy restrictions on regular users. Normally, checkKeyValid() should return owner true for rootCreds. In the affected version, policy restriction did not work properly for users who did not have service (svc) or security token service (STS) accounts. This issue is fixed in `RELEASE.2021-10-13T00-23-17Z`. A downgrade back to release `RELEASE.2021-10-08T23-58-24Z` is available as a workaround.

Rincian

Terbit di NVD

13 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/minio/minio/commit/415bbc74aacd53a120e54a663e941b1809982dbd patch · advisory pihak ketiga
• https://github.com/minio/minio/pull/13388 patch · advisory pihak ketiga
• https://github.com/minio/minio/pull/13422 patch · advisory pihak ketiga
• https://github.com/minio/minio/security/advisories/GHSA-v64v-g97p-577c advisory pihak ketiga