CVE-2020-11012 - CVE House
Back to Database
Status published Critical CVE-2020-11012

Authentication bypass MinIO Admin API

Vulnerability Description

MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-11012

Credits & Attribution

No credits recorded in the NVD database.

References

Affected Vendor

Affected Software

minio
Vulnerable Versions:
< RELEASE.2020-04-23T00-58-49Z

Timeline

Official Publish: April 23rd, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Weaknesses (CWE)

CWE-305

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.