{"id":"CVE-2024-55949","published":"2024-12-16T20:02:00Z","modified":"2024-12-16T20:18:46Z","title":"Privilege escalation in IAM import API in MinIO","vendor":"minio","product":"minio","tier":"tail","description":{"text":"MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in commit `f246c9053f9603e610d98439799bdd2a6b293427` which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00608,"percentile":0.49095,"provenance":"source"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"references":[{"url":"https://github.com/minio/minio/security/advisories/GHSA-cwq8-g58r-32hg","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/minio/minio/pull/20756","tags":["x_refsource_MISC"]},{"url":"https://github.com/minio/minio/commit/580d9db85e04f1b63cc2909af50f0ed08afa965f","tags":["x_refsource_MISC"]},{"url":"https://github.com/minio/minio/commit/f246c9053f9603e610d98439799bdd2a6b293427","tags":["x_refsource_MISC"]}],"priority":{"score":16.3,"factors":[{"name":"EPSS percentile","points":9.82},{"name":"CVSS severity","points":6.51}]},"vendorSlug":"minio","affectedVersions":[{"vendor":"minio","product":"minio","versions":[">= RELEASE.2022-06-25T15-50-16Z, < RELEASE.2024-12-13T22-19-12Z"]}],"affected":[{"ecosystem":"Go","package":"github.com/minio/minio","vulnerableRanges":[">=0.0.0-20220623162515-580d9db85e04, <0.0.0-20241213221912-68b004a48f41"],"patched":["0.0.0-20241213221912-68b004a48f41"],"from":["GHSA-cwq8-g58r-32hg","GO-2024-3336"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3532","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-minio-cve-2023-28434","parents":[{"from":"CVE-2024-24747","to":"CVE-2024-55949","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["cmd/admin-handlers-users.go"],"commits":["https://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776","https://github.com/minio/minio/commit/580d9db85e04f1b63cc2909af50f0ed08afa965f","https://github.com/minio/minio/commit/f246c9053f9603e610d98439799bdd2a6b293427"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-28433","published":"2023-03-22","fixed":"0.0.0-202303200735","kev":false},{"cve":"CVE-2024-24747","published":"2024-01-31","fixed":"0.0.0-20240131185645-0ae4915a9391","kev":false},{"cve":"CVE-2024-36107","published":"2024-05-28","fixed":"0.0.0-20240527191746-e0fe7cc39172","kev":false,"link":{"from":"CVE-2024-36107","to":"CVE-2024-55949","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/minio/minio","fromFixed":"0.0.0-20240527191746-e0fe7cc39172","toFixed":"0.0.0-20241213221912-68b004a48f41","daysApart":202}]}},{"cve":"CVE-2024-55949","published":"2024-12-16","fixed":"0.0.0-20241213221912-68b004a48f41","kev":false},{"cve":"CVE-2025-27414","published":"2025-02-28","fixed":"0.0.0-20250227184332-4c71f1b4ec0f","kev":false,"link":{"from":"CVE-2024-55949","to":"CVE-2025-27414","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/minio/minio","fromFixed":"0.0.0-20241213221912-68b004a48f41","toFixed":"0.0.0-20250227184332-4c71f1b4ec0f","daysApart":74}]}},{"cve":"CVE-2025-31489","published":"2025-04-03","fixed":"0.0.0-20250403145552-8c70975283f9","kev":false},{"cve":"CVE-2025-62506","published":"2025-10-16","fixed":"0.0.0-20251015170045-c1a49490c78e","kev":false}],"package":"Go:github.com/minio/minio"}}