CVE-2022-35919

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin:ServerUpdate` can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow access to contents at any arbitrary paths that are readable by MinIO process. Users are advised to upgrade. Users unable to upgrade may disable ServerUpdate API by denying the `admin:ServerUpdate` action for your admin users via IAM policies.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Aug 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-35926.5A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured sh CVE-2022-359207.5Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` i CVE-2022-359214.3fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by CVE-2022-359227.5Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an ou CVE-2022-359237.5v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in th CVE-2022-359249.1NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` CVE-2022-359259.8BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which al CVE-2022-359267.5Contiki-NG is an open-source, cross-platform operating system for IoT devices. Because of insufficient validation of IPv6 neighbor discovery CVE-2022-359279.8Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the Con CVE-2022-359285.5AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version CVE-2022-359299.8cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation ex CVE-2022-359308.8PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will r