CVE-2023-25812 MEDIUM

CVE-2023-25812: Allowed DELETE on resources on object locked buckets under Governance mode in Minio

Vendor Minio
Product minio
Weakness CWE-281
Published February 21, 2023
Last update March 10, 2025
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Governance-Retention: true`. However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted. All users are advised to upgrade. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

February 21, 2023 CVE published
March 10, 2025 Record updated