CVE-2020-11012

ADVISORY - nist

Summary

MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.

EPSS Score⁠: 0.00192 (0.409)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-305⁠

Authentication Bypass by Primary Weakness

CWE-755⁠

Improper Handling of Exceptional Conditions

ADVISORY - gitlab

CWE-1035⁠

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

CWE-755⁠

Improper Handling of Exceptional Conditions

CWE-937⁠

OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities

Impacted images

Advisories

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.