PT-2025-14797 · Minio+2 · Minio+2
CVE-2025-31489
·
Published
2025-04-03
·
Updated
2025-09-22
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
MinIO versions prior to RELEASE.2025-04-03T14-56-28Z
Description
The issue concerns an authorization flaw in MinIO, a high-performance object storage system. This flaw allows a client with prior WRITE permissions on a bucket to upload objects using any arbitrary secret, given that they have knowledge of the access-key and bucket name. With the necessary information in place, uploading random objects to buckets can be done easily.
Recommendations
For versions prior to RELEASE.2025-04-03T14-56-28Z, update to RELEASE.2025-04-03T14-56-28Z or later to resolve the issue. As a temporary workaround, consider restricting WRITE permissions on buckets to minimize the risk of exploitation.
Exploit
Fix
DoS
Improper Verification of Cryptographic Signature
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Minio
Red Os