CVE-2023-33955

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
minio	console	< 0.28.0

References

Timeline

Published: May 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-339566.5Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insec CVE-2023-339575.7notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high nu CVE-2023-339586.5notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high nu CVE-2023-339598.8notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to CVE-2023-33966.5A vulnerability was found in Campcodes Retro Cellphone Online Store 1.0. It has been declared as critical. Affected by this vulnerability is CVE-2023-339607.5OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server CVE-2023-339615.4Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can i CVE-2023-339626.1JStachio is a type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes `'` in HTML, allowi CVE-2023-339639.8DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the Data CVE-2023-339647.5mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard mi CVE-2023-339658.8Brook is a cross-platform programmable network tool. The `tproxy` server is vulnerable to a drive-by command injection. An attacker may fool CVE-2023-339669.8Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `no