CVE-2020-11012: Authentication bypass MinIO Admin API
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-11012?
CVE-2020-11012 is classified as a medium severity vulnerability due to the authentication bypass issue it presents.
How does CVE-2020-11012 affect MinIO?
CVE-2020-11012 allows unauthenticated users with an admin access key to perform sensitive admin operations without the admin secret key.
What versions of MinIO are affected by CVE-2020-11012?
MinIO versions before RELEASE.2020-04-23T00-58-49Z are affected by CVE-2020-11012.
How do I fix CVE-2020-11012?
To mitigate CVE-2020-11012, upgrade MinIO to version RELEASE.2020-04-23T00-58-49Z or later.
Is it possible to exploit CVE-2020-11012 remotely?
Yes, CVE-2020-11012 can be exploited remotely given that an admin access key is available.