Details of VAR-202303-1844

ID

VAR-202303-1844

CVE

CVE-2023-28432

TITLE

Minio Inc. of Minio Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-005841

DESCRIPTION

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z. Minio Inc. of Minio Exists in unspecified vulnerabilities.Information may be obtained

Trust: 1.71

sources: NVD: CVE-2023-28432 // JVNDB: JVNDB-2023-005841 // VULMON: CVE-2023-28432

AFFECTED PRODUCTS

vendor:	minio	model:	minio	scope:	gte	version:	2019-12-17t23-16-33z	Trust: 1.0
vendor:	minio	model:	minio	scope:	lt	version:	2023-03-20t20-16-18z	Trust: 1.0
vendor:	minio	model:	minio	scope:	eq	version:	2019-12-17t23-16-33z that's all 2023-03-20t20-16-18z	Trust: 0.8
vendor:	minio	model:	minio	scope:	eq	version:	-	Trust: 0.8
vendor:	minio	model:	minio	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2023-005841 // NVD: CVE-2023-28432

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2023-28432
value:	HIGH
Trust: 1.8
security-advisories@github.com:	CVE-2023-28432
value:	HIGH
Trust: 1.0
CNNVD:	CNNVD-202303-1795
value:	HIGH
Trust: 0.6

NVD:
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 2.0
NVD:	CVE-2023-28432
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2023-005841 // NVD: CVE-2023-28432 // NVD: CVE-2023-28432 // CNNVD: CNNVD-202303-1795

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2023-005841 // NVD: CVE-2023-28432

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202303-1795

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-202303-1795

CONFIGURATIONS

sources: NVD: CVE-2023-28432

PATCH

title:	MinIO Repair measures for information disclosure vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqbyid.tag?id=230693	Trust: 0.6
title:	-	url:	https://github.com/atk7r/taichi	Trust: 0.1

sources: VULMON: CVE-2023-28432 // CNNVD: CNNVD-202303-1795

EXTERNAL IDS

db:	NVD	id:	CVE-2023-28432	Trust: 3.3
db:	JVNDB	id:	JVNDB-2023-005841	Trust: 0.8
db:	CNNVD	id:	CNNVD-202303-1795	Trust: 0.6
db:	VULMON	id:	CVE-2023-28432	Trust: 0.1

sources: VULMON: CVE-2023-28432 // JVNDB: JVNDB-2023-005841 // NVD: CVE-2023-28432 // CNNVD: CNNVD-202303-1795

REFERENCES

url:	https://github.com/minio/minio/releases/tag/release.2023-03-20t20-16-18z	Trust: 2.4
url:	https://github.com/minio/minio/security/advisories/ghsa-6xvq-wj2x-3h3q	Trust: 2.4
url:	https://twitter.com/andrew___morris/status/1639325397241278464	Trust: 2.4
url:	https://viz.greynoise.io/tag/minio-information-disclosure-attempt	Trust: 2.4
url:	https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-clean	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2023-28432	Trust: 0.8
url:	https://www.cisa.gov/known-exploited-vulnerabilities-catalog	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2023-28432/	Trust: 0.6

sources: JVNDB: JVNDB-2023-005841 // NVD: CVE-2023-28432 // CNNVD: CNNVD-202303-1795

SOURCES

db:	VULMON	id:	CVE-2023-28432
db:	JVNDB	id:	JVNDB-2023-005841
db:	NVD	id:	CVE-2023-28432
db:	CNNVD	id:	CNNVD-202303-1795

LAST UPDATE DATE

2023-12-18T13:46:06.047000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2023-28432	date:	2023-03-23T00:00:00
db:	JVNDB	id:	JVNDB-2023-005841	date:	2023-11-10T04:23:00
db:	NVD	id:	CVE-2023-28432	date:	2023-11-07T04:10:35.500
db:	CNNVD	id:	CNNVD-202303-1795	date:	2023-03-29T00:00:00

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2023-28432	date:	2023-03-22T00:00:00
db:	JVNDB	id:	JVNDB-2023-005841	date:	2023-11-10T00:00:00
db:	NVD	id:	CVE-2023-28432	date:	2023-03-22T21:15:18.257
db:	CNNVD	id:	CNNVD-202303-1795	date:	2023-03-22T00:00:00