{"id":"CVE-2024-36107","published":"2024-05-28T18:50:51Z","modified":"2024-09-03T15:28:54Z","title":"Information disclosure in minio","vendor":"minio","product":"minio","tier":"tail","description":{"text":"MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` and `If-Unmodified-Since` headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a specific bucket and also gain access to some amount of\ninformation such as  `Last-Modified (of the latest version)`, `Etag (of the latest version)`, `x-amz-version-id (of the latest version)`, `Expires (metadata value of the latest version)`, `Cache-Control (metadata value of the latest version)`. This conditional check was being honored before validating if the anonymous access is indeed allowed on the metadata of an object. This issue has been addressed in commit `e0fe7cc3917`. Users must upgrade to RELEASE.2024-05-27T19-17-46Z for the fix. There are no known workarounds for this issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00629,"percentile":0.50122,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://github.com/minio/minio/security/advisories/GHSA-95fr-cm4m-q5p9","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/minio/minio/pull/19810","tags":["x_refsource_MISC"]},{"url":"https://github.com/minio/minio/commit/e0fe7cc391724fc5baa85b45508f425020fe4272","tags":["x_refsource_MISC"]},{"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Modified-Since","tags":["x_refsource_MISC"]},{"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Unmodified-Since","tags":["x_refsource_MISC"]}],"priority":{"score":13.7,"factors":[{"name":"EPSS percentile","points":10.02},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"minio","affectedVersions":[{"vendor":"minio","product":"minio","versions":["< RELEASE.2024-05-27T19-17-46Z"]}],"affected":[{"ecosystem":"Go","package":"github.com/minio/minio","vulnerableRanges":["<0.0.0-20240527191746-e0fe7cc39172"],"patched":["0.0.0-20240527191746-e0fe7cc39172"],"from":["GHSA-95fr-cm4m-q5p9","GO-2024-2886"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1541","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-minio-cve-2023-28434","children":[{"from":"CVE-2024-36107","to":"CVE-2025-31489","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["cmd/object-handlers.go"],"commits":["https://github.com/minio/minio/commit/e0fe7cc391724fc5baa85b45508f425020fe4272","https://github.com/minio/minio/commit/8c70975283f9f4ce80f331a25c7475a36279e519"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-28434","published":"2023-03-22","fixed":"0.0.0-202303200415","kev":true},{"cve":"CVE-2023-28433","published":"2023-03-22","fixed":"0.0.0-202303200735","kev":false},{"cve":"CVE-2024-24747","published":"2024-01-31","fixed":"0.0.0-20240131185645-0ae4915a9391","kev":false,"link":{"from":"CVE-2024-24747","to":"CVE-2024-36107","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/minio/minio","fromFixed":"0.0.0-20240131185645-0ae4915a9391","toFixed":"0.0.0-20240527191746-e0fe7cc39172","daysApart":118}]}},{"cve":"CVE-2024-36107","published":"2024-05-28","fixed":"0.0.0-20240527191746-e0fe7cc39172","kev":false},{"cve":"CVE-2024-55949","published":"2024-12-16","fixed":"0.0.0-20241213221912-68b004a48f41","kev":false,"link":{"from":"CVE-2024-36107","to":"CVE-2024-55949","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/minio/minio","fromFixed":"0.0.0-20240527191746-e0fe7cc39172","toFixed":"0.0.0-20241213221912-68b004a48f41","daysApart":202}]}},{"cve":"CVE-2025-27414","published":"2025-02-28","fixed":"0.0.0-20250227184332-4c71f1b4ec0f","kev":false},{"cve":"CVE-2025-31489","published":"2025-04-03","fixed":"0.0.0-20250403145552-8c70975283f9","kev":false}],"package":"Go:github.com/minio/minio"}}