CVE-2021-43858

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269 CWE-863

Affected software

Vendor	Product	Versions
minio	minio	< RELEASE.2021-12-27T07-23-18Z

References

https://github.com/minio/minio/commit/5a96cbbeaabd0a82b0fe881378e7c21c85091abfPatch, Third Party Advisory
https://github.com/minio/minio/pull/13976Patch, Third Party Advisory
https://github.com/minio/minio/pull/7949Patch, Third Party Advisory
https://github.com/minio/minio/releases/tag/RELEASE.2021-12-27T07-23-18ZRelease Notes, Third Party Advisory
https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cxPatch, Third Party Advisory
https://github.com/minio/minio/commit/5a96cbbeaabd0a82b0fe881378e7c21c85091abfPatch, Third Party Advisory
https://github.com/minio/minio/pull/13976Patch, Third Party Advisory
https://github.com/minio/minio/pull/7949Patch, Third Party Advisory
https://github.com/minio/minio/releases/tag/RELEASE.2021-12-27T07-23-18ZRelease Notes, Third Party Advisory
https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cxPatch, Third Party Advisory

Timeline

Published: Dec 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-438597.5XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to a CVE-2021-43864.3The WP Security Question plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5. This is d CVE-2021-438608.6Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate CVE-2021-438615.4Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify CVE-2021-438625.4jQuery Terminal Emulator is a plugin for creating command line interpreters in your applications. Versions prior to 2.31.1 contain a low imp CVE-2021-438637.5The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content p CVE-2021-43878.8The Opal Estate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.11. This is due to mi CVE-2021-438757.8Microsoft Office Graphics Remote Code Execution Vulnerability CVE-2021-438768.8Microsoft SharePoint Elevation of Privilege Vulnerability CVE-2021-438778.8ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability CVE-2021-43885.3The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due CVE-2021-438805.5Windows Mobile Device Management Elevation of Privilege Vulnerability