8.8

CVE-2023-28433: Minio Privilege Escalation on Windows via Path separator manipulation

Modified
AliasesCGA-692q-ghp6-3qm7CGA-g76v-6p24-6mv2CGA-q679-xcfj-v3fq
Published 22-03-2023Last modified 25-02-2025

Vulnerability summary

CVE-2023-28433 is a high (CVSS 8.8) Exposure of Resource to Wrong Sphere vulnerability in minio. EPSS estimates a 0.98% chance of exploitation in the next 30 days, higher than 61.8% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.98%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 3
CGA-96V6-7Q2F-4GC3CGA-QPV5-5R7V-WWRMUBUNTU-CVE-2023-28433

Timeline

  1. 22-03-2023
    PublishedVulnerability first disclosed.
  2. 25-02-2025
    Last modifiedVulnerability information updated.

Description

Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user. This issue is patched in RELEASE.2023-03-20T20-16-18Z. There are no known workarounds.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.98%

Chance of exploitation in the next 30 days

Percentile

62%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.98% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard2 products
  • minio< 0.20230413.030807-r0
  • minio-iamguarded-2025-compat< 0.20230413.030807-r0
Wolfi2 products
  • minio< 0.20230413.030807-r0
  • minio-iamguarded-2025-compat< 0.20230413.030807-r0
Github.com/minio1 product
  • minio< 0.0.0-202303200735
Minio1 product
  • minio< RELEASE.2023-03-20T20-16-18Z | < 2023-03-20t20-16-18z

4 vendors · 6 products

References

7 links