VDB
CVE-2022-24842
CVE-2022-24842
PUBLISHED
CVSS 8.800000190734863 HIGH
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials. This in turn allows the user to escalate privilege to that of the root user. This vulnerability has been resolved in pull request #14729 and is included in `RELEASE.2022-04-12T06-55-35Z`. Users unable to upgrade may workaround this issue by explicitly adding a `admin:CreateServiceAccount` deny policy, however, this, in turn, denies the user the ability to create their own service accounts as well.
EPSS 2.12% · 80.7th percentile
Risk Scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
2.12%
80.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | minio | 2021.12.09 |
| Bitnami | minio | 2021.12.09 |
Timeline
- Apr 12, 2022 CVE Published
- Apr 13, 2022 EPSS Score
- Jun 3, 2022 EPSS Score
- Jul 24, 2022 EPSS Score
- Sep 13, 2022 EPSS Score
- Nov 2, 2022 EPSS Score
- Dec 23, 2022 EPSS Score
- Feb 11, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 23, 2023 EPSS Score
- Jun 8, 2023 CVE Updated
- Jul 13, 2023 EPSS Score