Unrated severityNVD Advisory· Published Dec 27, 2021· Updated Aug 4, 2024
User privilege escalation in MinIO
CVE-2021-43858
Description
MinIO is a Kubernetes native application for cloud storage. Prior to version RELEASE.2021-12-27T07-23-18Z, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version RELEASE.2021-12-27T07-23-18Z changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit Deny rule to disable the API for users.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
11- osv-coords9 versionspkg:apk/chainguard/miniopkg:apk/chainguard/minio-bitnami-2024-compatpkg:apk/chainguard/minio-bitnami-2025-compatpkg:apk/chainguard/minio-iamguarded-2025-compatpkg:apk/wolfi/miniopkg:apk/wolfi/minio-bitnami-2024-compatpkg:apk/wolfi/minio-bitnami-2025-compatpkg:apk/wolfi/minio-iamguarded-2025-compatpkg:bitnami/minio
< 0+ 8 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 2021.12.27
Patches
Vulnerability mechanics
References
5- github.com/minio/minio/commit/5a96cbbeaabd0a82b0fe881378e7c21c85091abfmitrex_refsource_MISC
- github.com/minio/minio/pull/13976mitrex_refsource_MISC
- github.com/minio/minio/pull/7949mitrex_refsource_MISC
- github.com/minio/minio/releases/tag/RELEASE.2021-12-27T07-23-18Zmitrex_refsource_MISC
- github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cxmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.