CVE-2023-28432

HIGH EPSS 99.7%
Published Mar 22, 20233y ago · Modified Jun 17, 20261w ago
7.5 CVSS 3.1
High
Find Similar
Published Mar 22, 2023 3y ago
Last Modified Jun 17, 2026 1w ago

Description

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
99.7% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure

Affected Products 1

VendorProductVersionRange
miniominio*≥2019-12-17t23-16-33z  –  <2023-03-20t20-16-18z

References 6

  • github.com https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z
    Release Notes
  • github.com https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q
    ExploitVendor Advisory
  • twitter.com https://twitter.com/Andrew___Morris/status/1639325397241278464
    Third Party Advisory
  • viz.greynoise.io https://viz.greynoise.io/tag/minio-information-disclosure-attempt
    Third Party Advisory
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28432
    US Government Resource
  • greynoise.io https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-clean
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.