CVE-2023-27589: Minio vulnerable to denial of access by an admin privileged user for root credential
Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with consoleAdmin permissions can potentially create a user that matches the root credential accessKey. Once this user is created successfully, the root credential ceases to work appropriately. The issue is patched in RELEASE.2023-03-13T19-46-17Z. There are ways to work around this via adding higher privileges to the disabled root user via mc admin policy set.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-27589?
CVE-2023-27589 is considered a critical vulnerability as it allows a user with consoleAdmin permissions to create a user matching the root credential.
How do I fix CVE-2023-27589?
To fix CVE-2023-27589, upgrade Minio to a version released after 2023-03-13T19:46:17Z.
What versions of Minio are affected by CVE-2023-27589?
CVE-2023-27589 affects Minio versions from RELEASE.2020-12-23T02-24-12Z to RELEASE.2023-03-13T19-46-17Z.
Who is impacted by CVE-2023-27589?
Users with consoleAdmin permissions on affected Minio versions are impacted by CVE-2023-27589.
What can be done to mitigate CVE-2023-27589 until a fix is applied?
Until a fix is applied, minimize the assignment of consoleAdmin permissions and review user access rights.