PT-2022-23025

CVE-2022-35919

Published

2022-07-29

Updated

2024-12-26

Description by

CVSS 3.1

7.4

High

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions MinIO (affected versions not specified)

Description The issue affects MinIO, a High Performance Object Storage, where admin users authorized for admin:ServerUpdate can trigger an error that returns the content of the requested path. This allows access to contents at arbitrary paths readable by the MinIO process.

Recommendations For all affected versions, users are advised to upgrade. As a temporary workaround, consider disabling the ServerUpdate API by denying the admin:ServerUpdate action for admin users via IAM policies.

Exploitability

Exploit

Fix

Impacts

Researchers

Alevsk

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2022-35919