CVE-2021-21362

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who uses MinIO multi-users. This is fixed in version RELEASE.2021-03-04T00-53-13Z. As a workaround, one can disable uploads with `Content-Type: multipart/form-data` as mentioned in the S3 API RESTObjectPOST docs by using a proxy in front of MinIO.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-285 CWE-863

Affected software

Vendor	Product	Versions
minio	minio	< RELEASE.2021-03-04T00-53-13Z

References

https://github.com/minio/minio/commit/039f59b552319fcc2f83631bb421a7d4b82bc482Patch, Third Party Advisory
https://github.com/minio/minio/pull/11682Exploit, Third Party Advisory
https://github.com/minio/minio/releases/tag/RELEASE.2021-03-04T00-53-13ZRelease Notes, Third Party Advisory
https://github.com/minio/minio/security/advisories/GHSA-hq5j-6r98-9m8vThird Party Advisory
https://github.com/minio/minio/commit/039f59b552319fcc2f83631bb421a7d4b82bc482Patch, Third Party Advisory
https://github.com/minio/minio/pull/11682Exploit, Third Party Advisory
https://github.com/minio/minio/releases/tag/RELEASE.2021-03-04T00-53-13ZRelease Notes, Third Party Advisory
https://github.com/minio/minio/security/advisories/GHSA-hq5j-6r98-9m8vThird Party Advisory

Timeline

Published: Mar 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-213637.0swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in CVE-2021-213645.5swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in CVE-2021-213655.4Bootstrap Package is a theme for TYPO3. It has been discovered that rendering content in the website frontend is vulnerable to cross-site sc CVE-2021-213664.3xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do CVE-2021-213678.1Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect authorization vulnerabilit CVE-2021-213688.8msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototy CVE-2021-213696.5Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-s CVE-2021-21378.8Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework). Supported versions CVE-2021-213705.4TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has bee CVE-2021-213718.6Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks base CVE-2021-213728.8Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used CVE-2021-213735.9Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fet