CISA KEV · Known exploitedHigh

CVE-2023-28432

MinIO

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

CVSS: 7.5
EPSS: 84.0%
CISA KEV: Listed
Published: 2023.03.23

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability84.0%

Technical severityCVSS 7.5

Vulnerability overview

Affected product and versions

Product: MinIO
Affected versions: >= RELEASE.2019-12-17T23-16-33Z, < RELEASE.2023-03-20T20-16-18Z, >= 2019-12-17t23-16-33z < 2023-03-20t20-16-18z
Fixed versions: 2023-03-20t20-16-18z

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2023.05.12

1
Identify
Confirm that MinIO and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-200
KEV added: 2023.04.21
Ransomware use: 미확인