High severity · published Feb 21, 2023
CVE-2023-25812
Allowed DELETE on resources on object locked buckets under Governance mode in Minio
8.8
CVSS
1%
EPSS
No
On KEV
Description
Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Governance-Retention: true`. However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted. All users are advised to upgrade. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
minio · minio
>= RELEASE.2020-04-10T03-34-42Z, < RELEASE.2023-02-17T17-52-43Z · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-25812
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-25812
Patch
https://github.com/minio/minio/commit/a7188bc9d0f0a5ae05aaf1b8126bcd3cb3fdc485
Issue Tracking
https://github.com/minio/minio/pull/16635
Exploit
https://github.com/minio/minio/security/advisories/GHSA-c8fc-mjj8-fc63
More from minio
8.8
CVE-2023-28434
MinIO is vulnerable to privilege escalation on Linux/MacOS
7.5
CVE-2023-28432
Minio Information Disclosure in Cluster Deployment
9.8
CVE-2026-33322
MinIO: JWT Algorithm Confusion in OIDC Authentication
9.3
CVE-2024-55949
Privilege escalation in IAM import API in MinIO
8.8
CVE-2024-24747
MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation