CVE-2023-28432

Katalog CVE

CVSS 7.5 · High KEV · sudah dieksploitasi EPSS 84,0%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada minio. Skor CVSS 3.1 7.5 (High) menurut NVD. Masuk katalog KEV CISA pada 21 April 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

Rincian

Terbit di NVD

22 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

84,0% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

MinIO Information Disclosure Vulnerability

Masuk KEV

21 April 2023

Tenggat CISA

12 Mei 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q exploit · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28432 pemerintah AS
• https://twitter.com/Andrew___Morris/status/1639325397241278464 advisory pihak ketiga
• https://viz.greynoise.io/tag/minio-information-disclosure-attempt advisory pihak ketiga
• https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-c... advisory pihak ketiga
• https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z release notes