CVE-2023-25812: minio — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2023-25812

CVSS 8.8 · High EPSS 0,96%

Kerentanan Improper Preservation of Permissions pada minio. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Governance-Retention: true`. However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted. All users are advised to upgrade. There are no known workarounds for this issue.

Rincian

Terbit di NVD: 21 Februari 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-281: Improper Preservation of Permissions
EPSS (30 hari): 0,96% peluang dieksploitasi; lebih tinggi dari 60,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
minio	minio	Versi 2020-04-10t03-34-42z hingga sebelum 2023-02-17t17-52-43z

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/minio/minio/security/advisories/GHSA-c8fc-mjj8-fc63 exploit · advisory vendor
https://github.com/minio/minio/commit/a7188bc9d0f0a5ae05aaf1b8126bcd3cb3fdc485 patch
https://github.com/minio/minio/pull/16635 issue tracking · patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.