7.5

CVE-2023-28432: MinIO Information Disclosure Vulnerability

KEV
Analyzed
AliasesGHSA-6xvq-wj2x-3h3q
Published 22-03-2023Last modified 21-10-2025

Vulnerability summary

CVE-2023-28432 is a high (CVSS 7.5) vulnerability in MinIO. It is known to be exploited: CISA lists it, first on 21-04-2023. EPSS estimates a 83.96% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
83.96%
0%100%
Critical · 0.00 pp in 30 days
KEVExploited in the wildCritical · listed in 1 catalog
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2github, metasploit

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
UBUNTU-CVE-2023-28432

Timeline

  1. 22-03-2023
    PublishedVulnerability first disclosed.
  2. 21-04-2023
    Added to CISA KEVExploitedMinIO Information Disclosure Vulnerability
  3. 12-05-2023
    CISA remediation dueDeadline passedApply updates per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

83.96%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 83.96% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
21-04-2023
Federal due date
12-05-2023
ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply updates per vendor instructions. github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q nvd.nist.gov/vuln/detail/CVE-2023-28432

Public exploits

2 found
  • githubUnverified

    Minio

    Maturity: poc

  • MetasploitMetasploitremoteUnverified

    MinIO Bootstrap Verify Information Disclosure

    auxiliary/gather/minio_bootstrap_verify_info_disc

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Minio1 product
  • minio≥ RELEASE.2019-12-17T23-16-33Z, < RELEASE.2023-03-20T20-16-18Z | ≥ 2019-12-17t23-16-33z, < 2023-03-20t20-16-18z

1 vendor · 1 product

References

6 links