Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2023-28432
CVE-2023-28432:
MinIO vulnerability analysis and mitigation
Overview
CVE-2023-28432 is a critical information disclosure vulnerability discovered in MinIO, a Multi-Cloud Object Storage framework. The vulnerability affects MinIO cluster deployments starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z. The vulnerability has a CVSS score of 7.5 (High) and was disclosed on March 22, 2023 (NVD, GitHub Advisory).
Technical details
The vulnerability occurs in the VerifyHandler function within the bootstrap-peer-server.go file of the MinIO source code. When MinIO returns all environment variables, it includes sensitive information such as MINIOSECRETKEY and MINIOROOTPASSWORD. The vulnerable code retrieves all environment variables that start with the MINIO_ prefix and returns them in the system configuration (GitHub Advisory).
Impact
The vulnerability can lead to the exposure of sensitive information, including secret keys and passwords, to unauthorized parties. This could allow attackers to access and manipulate data stored in the MinIO cluster without proper authorization. The vulnerability affects all users of distributed deployment (SentinelOne).
Mitigation and workarounds
Users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z or later to mitigate the risk of information disclosure. The vulnerability was patched in commit 3b5dbf90468b874e99253d241d16d175c2454077. There are no known workarounds for this vulnerability (GitHub Release).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management