CVE-2021-21362 - CVE House
Back to Database
Status published High CVE-2021-21362

Bypassing readOnly policy by creating a temporary 'mc share upload' URL

Vulnerability Description

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who uses MinIO multi-users. This is fixed in version RELEASE.2021-03-04T00-53-13Z. As a workaround, one can disable uploads with `Content-Type: multipart/form-data` as mentioned in the S3 API RESTObjectPOST docs by using a proxy in front of MinIO.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-21362

Credits & Attribution

No credits recorded in the NVD database.

References

More from minio

View All →
CVE-2025-62506
MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS
High 8.1
CVE-2025-59952
minio-java Client XML Tag is Vulnerable to Value Substitution
High 8.7
CVE-2025-32963
Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS
Medium 6.9
CVE-2025-31489
MinIO performs incomplete signature validation for unsigned-trailer uploads
High 8.7
CVE-2025-27414
MinIO SFTP authentication bypass due to improperly trusted SSH key
Medium 4.6

Affected Vendor

Affected Software

minio
Vulnerable Versions:
< RELEASE.2021-03-04T00-53-13Z

Timeline

Official Publish: March 8th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Weaknesses (CWE)

CWE-285

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion