{"cve":"CVE-2023-28434","nvd":{"published":"2023-03-22T21:15:18.427","modified":"2026-06-17T05:47:43.610","status":"Analyzed","description":"Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-269"],"references":["https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5","https://github.com/minio/minio/pull/16849","https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c","https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5","https://github.com/minio/minio/pull/16849"],"products":["minio:minio"],"source":"nvd","synced_at":"2026-10-19T21:37:48.383111019+00:00"},"epss":{"cve":"CVE-2023-28434","score":0.07917,"percentile":0.94724,"date":"2026-10-31"},"kev":{"cve":"CVE-2023-28434","date_added":"2023-09-19","due_date":"2023-10-10","vendor":"MinIO","product":"MinIO","known_ransomware":false},"osv":[{"id":"GHSA-2pxw-r47w-4p8c","url":"https://osv.dev/vulnerability/GHSA-2pxw-r47w-4p8c","summary":"Privilege Escalation on Linux/MacOS","modified":"2026-10-08T08:11:01.963531191Z","packages":[{"ecosystem":"Go","name":"github.com/minio/minio","purl":"pkg:golang/github.com/minio/minio","ranges":["<0.0.0-202303200415"],"fixed":["0.0.0-202303200415"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}