High severity · published Apr 23, 2020
CVE-2020-11012
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API
7.5
CVSS
1.9%
EPSS
No
On KEV
Description
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Minio · Minio
before 2020-04-23t00-58-49z · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11012
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11012
Patch
https://github.com/minio/minio/commit/4cd6ca02c7957aeb2de3eede08b0754332a77923
Third Party Advisory
https://github.com/minio/minio/pull/9422
Third Party Advisory
https://github.com/minio/minio/releases/tag/RELEASE.2020-04-23T00-58-49Z
Patch
https://github.com/minio/minio/security/advisories/GHSA-xv4r-vccv-mg4w
More from Minio
8.8
CVE-2023-28434
MinIO is vulnerable to privilege escalation on Linux/MacOS
7.5
CVE-2023-28432
Minio Information Disclosure in Cluster Deployment
9.8
CVE-2026-33322
MinIO: JWT Algorithm Confusion in OIDC Authentication
9.3
CVE-2024-55949
Privilege escalation in IAM import API in MinIO
8.8
CVE-2024-24747
MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation