UpHeron
All vulnerabilities

Servers and applications

CVE-2023-28432

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to…

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 21 Apr 2023.

Severity
High 7.5
Published
22 Mar 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2023-03-20t20-16-18z
Sources
NVD

Affected software

SoftwareAffected versions
MinIOServers and applications · cpe:a:minio:minio
  • From 2019-12-17t23-16-33z before 2023-03-20t20-16-18z

Known exploited

CISA name
MinIO Information Disclosure Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
12 May 2023
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-28432
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-28432