CVE-2025-59952

Katalog CVE

CVSS 8.7 · High EPSS 0,49%

Kerentanan Improper Input Validation. Skor CVSS 4.0 8.7 (High) menurut github.com.

Deskripsi (NVD)

MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically substituted with their actual values during processing. This unintended behavior could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details, if such references were present in XML content from untrusted sources. This is fixed in version 8.6.0.

Rincian

Terbit di NVD

30 September 2025

Terakhir diubah

9 Oktober 2026

Status NVD

Deferred

CVSS 4.0

8.7 (High), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/minio/minio-java/commit/f7a98d06b25e5464bdd4811b044e25ff9101d37f
• https://github.com/minio/minio-java/releases/tag/8.6.0
• https://github.com/minio/minio-java/security/advisories/GHSA-h7rh-xfpj-hpcm