Insecure Permissions Affecting package, versions *



    Attack Complexity Low
    Scope Changed
    Integrity High

    Threat Intelligence

    EPSS 0.11% (42nd percentile)
Expand this section
6.5 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • published 9 Mar 2021
  • disclosed 9 Mar 2021
  • credit Unknown

How to fix?

A fix was pushed into the master branch but not yet published.

Overview is an open source object storage server compatible with Amazon S3 APIs.

Affected versions of this package are vulnerable to Insecure Permissions. MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who uses MinIO multi-users. This is fixed in version RELEASE.2021-03-04T00-53-13Z. As a workaround, one can disable uploads with Content-Type: multipart/form-data as mentioned in the S3 API RESTObjectPOST docs by using a proxy in front of MinIO.

Note: This vulnerability resolved since version RELEASE.2021-03-04T00-53-13Z.