Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

The version of MinIO installed on the remote host is prior to RELEASE.2023-03-20T20-16-18Z. It is, therefore, affected by an information disclosure vulnerability. When deployed in a cluster/in distributed mode MinIO returns all environment variables, including 'MINIO_SECRET_KEY' and 'MINIO_ROOT_PASSWORD', resulting in disclosure of sensitive information.

The version of MinIO installed on the remote host is prior to RELEASE.2023-03-20T20-16-18Z. It is, therefore, affected by multiple vulnerabilities:

  - When deployed in a cluster/in distributed mode  MinIO returns all environment variables, including   'MINIO_SECRET_KEY' and 'MINIO_ROOT_PASSWORD', resulting in information disclosure. (CVE-2023-28432)

  - An attacker can use crafted requests to bypass metadata bucket name checking and put an object into any   bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials with   arn:aws:s3:::* permission, as well as enabled Console API access. (CVE-2023-28434)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

MinIO is a multi-cloud and open-source object storage framework. When deployed in cluster mode, MinIO versions starting with RELEASE.2021-08-31T05-46-54Z and prior to RELEASE.2023-03_20T20-16-18Z suffer from an information disclosure vulnerability, exposing all environment variables, including sensitive information like MINIO_ROOT_PASSWORD or MINIO_SECRET_KEY.

ID	Name	Product	Family	Severity
189513	MinIO Information Disclosure (CVE-2023-28432)	Nessus	CGI abuses	high
181873	MinIO < RELEASE.2023-03-20T20-16-18Z Multiple Vulnerabilities	Nessus	Misc.	high
113870	MinIO Information Disclosure	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2023-28432

high

Tenable Plugins

high

high

high