CVE-2024-36107

Information disclosure in minio

Description

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` and `If-Unmodified-Since` headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a specific bucket and also gain access to some amount of information such as `Last-Modified (of the latest version)`, `Etag (of the latest version)`, `x-amz-version-id (of the latest version)`, `Expires (metadata value of the latest version)`, `Cache-Control (metadata value of the latest version)`. This conditional check was being honored before validating if the anonymous access is indeed allowed on the metadata of an object. This issue has been addressed in commit `e0fe7cc3917`. Users must upgrade to RELEASE.2024-05-27T19-17-46Z for the fix. There are no known workarounds for this issue.

Category

5.3
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.07%
Affected: minio minio
Published at:
Updated at:

References

Link Tags
https://github.com/minio/minio/security/advisories/GHSA-95fr-cm4m-q5p9
https://github.com/minio/minio/pull/19810
https://github.com/minio/minio/commit/e0fe7cc391724fc5baa85b45508f425020fe4272
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Modified-Since
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Unmodified-Since

Frequently Asked Questions

What is the severity of CVE-2024-36107?
CVE-2024-36107 has been scored as a medium severity vulnerability.
How to fix CVE-2024-36107?
To fix CVE-2024-36107, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-36107 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-36107 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-36107?
CVE-2024-36107 affects minio minio.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.