CVE-2022-35919 - CVE House

Back to Database

Status published High CVE-2022-35919

Authenticated requests for server update admin API allows path traversal in minio

7.4 CVSS

Vulnerability Description

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin:ServerUpdate` can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow access to contents at any arbitrary paths that are readable by MinIO process. Users are advised to upgrade. Users unable to upgrade may disable ServerUpdate API by denying the `admin:ServerUpdate` action for your admin users via IAM policies.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-35919

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from minio

View All →

MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STS

minio-java Client XML Tag is Vulnerable to Value Substitution

Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

MinIO performs incomplete signature validation for unsigned-trailer uploads

MinIO SFTP authentication bypass due to improperly trusted SSH key

Affected Vendor

minio

View all reports →

Affected Software

minio

Vulnerable Versions:

< RELEASE.2022-07-29T19-40-48Z

Timeline

Official Publish: August 1st, 2022

Last Modified: April 22nd, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1565.001 Stored Data Manipulation