VYPR
← All advisories
High severity8.8NVD Advisory· Published Jan 31, 2024· Updated Jun 17, 2026

CVE-2024-24747

CVE-2024-24747

Description

MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for s3:* actions, but also admin:* actions. Which means unless somewhere above in the access-key hierarchy, the admin rights are denied, access keys will be able to simply override their own s3 permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/minio/minioGo
< 0.0.0-20240131185645-0ae4915a93910.0.0-20240131185645-0ae4915a9391

Affected products

4
  • Minio/Minio2 versions
    cpe:2.3:a:minio:minio:2024-01-31t20-20-33z:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:minio:minio:2024-01-31t20-20-33z:*:*:*:*:*:*:*
    • (no CPE)range: < RELEASE.2024-01-31T20-20-33Z
  • osv-coords2 versions
    pkg:bitnami/miniopkg:golang/github.com/minio/minio
    >= 2024.1.31, < 2024.2.4+ 1 more
    • (no CPE)range: >= 2024.1.31, < 2024.2.4
    • (no CPE)range: < 0.0.0-20240131185645-0ae4915a9391

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.