Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-55949

Good to know:

icon

Date: December 16, 2024

MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit "580d9db85e04f1b63cc2909af50f0ed08afa965f". This issue has been addressed in commit "f246c9053f9603e610d98439799bdd2a6b293427" which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately.

Language: Go

Severity Score

Related Resources (7)

https://github.com/minio/minio
https://nvd.nist.gov/vuln/detail/CVE-2024-55949
https://github.com/minio/minio/security/advisories/GHSA-cwq8-g58r-32hg
https://github.com/minio/minio/commit/f246c9053f9603e610d98439799bdd2a6b293427
https://github.com/minio/minio/pull/20756
https://github.com/minio/minio/commit/580d9db85e04f1b63cc2909af50f0ed08afa965f
https://www.mend.io/vulnerability-database/CVE-2024-55949

Severity Score

Weakness Type (CWE)

Improper Privilege Management

CWE-269

Top Fix

icon

Upgrade Version

Upgrade to version github.com/minio/minio - v0.0.0-20241213221912-68b004a48f41

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us