5.3

CVE-2024-36107: Information disclosure in minio

Deferred
AliasesCGA-3mrm-xqvh-84q6CGA-j3m6-fxrg-9r64GHSA-95fr-cm4m-q5p9
Published 28-05-2024Last modified 03-09-2024

Vulnerability summary

CVE-2024-36107 is a medium (CVSS 5.3) vulnerability in minio. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.4% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.63%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-6WH6-2869-M8XXCGA-RQ5H-44G8-8973

Timeline

  1. 28-05-2024
    PublishedVulnerability first disclosed.
  2. 03-09-2024
    Last modifiedVulnerability information updated.

Description

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` and `If-Unmodified-Since` headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a specific bucket and also gain access to some amount of information such as `Last-Modified (of the latest version)`, `Etag (of the latest version)`, `x-amz-version-id (of the latest version)`, `Expires (metadata value of the latest version)`, `Cache-Control (metadata value of the latest version)`. This conditional check was being honored before validating if the anonymous access is indeed allowed on the metadata of an object. This issue has been addressed in commit `e0fe7cc3917`. Users must upgrade to RELEASE.2024-05-27T19-17-46Z for the fix. There are no known workarounds for this issue.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.63%

Chance of exploitation in the next 30 days

Percentile

49%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.63% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard1 product
  • minio< 0.20240613.225353-r0
Github.com/minio1 product
  • minio< 0.0.0-20240527191746-e0fe7cc39172
Minio1 product
  • minio< RELEASE.2024-05-27T19-17-46Z
Wolfi1 product
  • minio< 0.20240613.225353-r0

4 vendors · 4 products

References

8 links