CVE-2020-11012

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-305 CWE-755

Affected software

Vendor	Product	Versions
MinIO	minio	< RELEASE.2020-04-23T00-58-49Z

References

https://github.com/minio/minio/commit/4cd6ca02c7957aeb2de3eede08b0754332a77923Patch, Third Party Advisory
https://github.com/minio/minio/pull/9422Third Party Advisory
https://github.com/minio/minio/releases/tag/RELEASE.2020-04-23T00-58-49ZThird Party Advisory
https://github.com/minio/minio/security/advisories/GHSA-xv4r-vccv-mg4wPatch, Third Party Advisory
https://github.com/minio/minio/commit/4cd6ca02c7957aeb2de3eede08b0754332a77923Patch, Third Party Advisory
https://github.com/minio/minio/pull/9422Third Party Advisory
https://github.com/minio/minio/releases/tag/RELEASE.2020-04-23T00-58-49ZThird Party Advisory
https://github.com/minio/minio/security/advisories/GHSA-xv4r-vccv-mg4wPatch, Third Party Advisory

Timeline

Published: Apr 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-110135.0Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function i CVE-2020-110148.6Electron-Cash-SLP before version 3.6.2 has a vulnerability. All token creators that use the "Mint Tool" feature of the Electron Cash SLP Edi CVE-2020-110159.1A vulnerability has been disclosed in thinx-device-api IoT Device Management Server before version 2.5.0. Device MAC address can be spoofed.CVE-2020-110168.8IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user CVE-2020-110176.5In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the s CVE-2020-110186.5In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out o CVE-2020-110196.5In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOG_TRACE", a possible crash of application could occur due to a r CVE-2020-11028.8A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa CVE-2020-110209.8Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extens CVE-2020-110217.5Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redire CVE-2020-110226.1In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM man CVE-2020-110236.1In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even