{"id":"CVE-2023-28432","aliases":["EUVD-2023-32124","GHSA-6xvq-wj2x-3h3q"],"status":"published","title":"Minio Information Disclosure in Cluster Deployment","description":"Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY`\nand `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.83957,"percentile":0.99696,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-200"],"published":"2023-03-22T20:16:38Z","modified":"2026-10-28T02:31:11Z","kev":{"date_added":"2023-04-21","due_date":"2023-05-12","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-04-21"},{"source":"kev","since":"2023-04-21"}],"exploits":[{"source":"pocgithub","id":"Mr-xn/CVE-2023-28432","title":"Mr-xn/CVE-2023-28432","date":"2023-03-23","url":"https://github.com/Mr-xn/CVE-2023-28432"},{"source":"pocgithub","id":"gobysec/CVE-2023-28432","title":"gobysec/CVE-2023-28432","date":"2023-03-23","url":"https://github.com/gobysec/CVE-2023-28432"},{"source":"pocgithub","id":"MzzdToT/CVE-2023-28432","title":"MzzdToT/CVE-2023-28432","date":"2023-03-24","url":"https://github.com/MzzdToT/CVE-2023-28432"},{"source":"pocgithub","id":"Okaytc/minio_unauth_check","title":"Okaytc/minio_unauth_check","date":"2023-03-24","url":"https://github.com/Okaytc/minio_unauth_check"},{"source":"pocgithub","id":"acheiii/CVE-2023-28432","title":"acheiii/CVE-2023-28432","date":"2023-03-24","url":"https://github.com/acheiii/CVE-2023-28432"},{"source":"pocgithub","id":"steponeerror/Cve-2023-28432-","title":"steponeerror/Cve-2023-28432-","date":"2023-03-27","url":"https://github.com/steponeerror/Cve-2023-28432-"},{"source":"pocgithub","id":"Cuerz/CVE-2023-28432","title":"Cuerz/CVE-2023-28432","date":"2023-03-29","url":"https://github.com/Cuerz/CVE-2023-28432"},{"source":"pocgithub","id":"LHXHL/Minio-CVE-2023-28432","title":"LHXHL/Minio-CVE-2023-28432","date":"2023-04-06","url":"https://github.com/LHXHL/Minio-CVE-2023-28432"},{"source":"pocgithub","id":"h0ng10/CVE-2023-28432_docker","title":"h0ng10/CVE-2023-28432_docker","date":"2023-04-09","url":"https://github.com/h0ng10/CVE-2023-28432_docker"},{"source":"pocgithub","id":"CHINA-china/MinIO_CVE-2023-28432_EXP","title":"CHINA-china/MinIO_CVE-2023-28432_EXP","date":"2023-04-13","url":"https://github.com/CHINA-china/MinIO_CVE-2023-28432_EXP"},{"source":"pocgithub","id":"TaroballzChen/CVE-2023-28432-metasploit-scanner","title":"TaroballzChen/CVE-2023-28432-metasploit-scanner","date":"2023-05-27","url":"https://github.com/TaroballzChen/CVE-2023-28432-metasploit-scanner"},{"source":"pocgithub","id":"NET-Flowers/CVE-2023-28432","title":"NET-Flowers/CVE-2023-28432","date":"2023-08-28","url":"https://github.com/NET-Flowers/CVE-2023-28432"},{"source":"pocgithub","id":"Chocapikk/CVE-2023-28432","title":"Chocapikk/CVE-2023-28432","date":"2023-09-05","url":"https://github.com/Chocapikk/CVE-2023-28432"},{"source":"pocgithub","id":"yTxZx/CVE-2023-28432","title":"yTxZx/CVE-2023-28432","date":"2023-10-20","url":"https://github.com/yTxZx/CVE-2023-28432"},{"source":"pocgithub","id":"unam4/CVE-2023-28432-minio_update_rce","title":"unam4/CVE-2023-28432-minio_update_rce","date":"2023-11-26","url":"https://github.com/unam4/CVE-2023-28432-minio_update_rce"},{"source":"pocgithub","id":"C1ph3rX13/CVE-2023-28432","title":"C1ph3rX13/CVE-2023-28432","date":"2023-12-07","url":"https://github.com/C1ph3rX13/CVE-2023-28432"},{"source":"pocgithub","id":"netuseradministrator/CVE-2023-28432","title":"netuseradministrator/CVE-2023-28432","date":"2024-01-07","url":"https://github.com/netuseradministrator/CVE-2023-28432"},{"source":"pocgithub","id":"xk-mt/CVE-2023-28432","title":"xk-mt/CVE-2023-28432","date":"2024-01-11","url":"https://github.com/xk-mt/CVE-2023-28432"},{"source":"pocgithub","id":"BitWiz4rd/CVE-2023-28432","title":"BitWiz4rd/CVE-2023-28432","date":"2024-04-13","url":"https://github.com/BitWiz4rd/CVE-2023-28432"},{"source":"pocgithub","id":"cgi-italy-insula-processing/minio","title":"cgi-italy-insula-processing/minio","date":"2026-10-01","url":"https://github.com/cgi-italy-insula-processing/minio"},{"source":"metasploit","id":"auxiliary/gather/minio_bootstrap_verify_info_disc","title":"MinIO Bootstrap Verify Information Disclosure","type":"auxiliary","date":"2023-03-20","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/gather/minio_bootstrap_verify_info_disc"},{"source":"nuclei","id":"CVE-2023-28432","title":"MinIO Cluster Deployment - Information Disclosure","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28432.yaml"}],"products":[{"vendor":"minio","product":"minio"}],"references":[{"url":"https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://twitter.com/Andrew___Morris/status/1639325397241278464","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://viz.greynoise.io/tag/minio-information-disclosure-attempt","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://www.greynoise.io/blog/openai-minio-and-why-you-should-always-use-docker-cli-scan-to-keep-your-supply-chain-clean","tags":["x_transferred","Third Party Advisory","article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28432","tags":["government-resource","US Government Resource","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28432.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28432","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-28432","title":"Minio Information Disclosure in Cluster Deployment","description":"Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY`\nand `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.","status":"published","published":"2023-03-22T20:16:38.641Z","modified":"2025-10-21T23:15:22.503Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-32124","description":"Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY`\nand `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.","status":"published","published":"2023-03-22T20:16:38Z","modified":"2025-10-21T23:15:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"exploited_since":"2023-04-21","updated_at":"2026-11-02T20:31:26.48918Z"}],"kev":[{"id":"CVE-2023-28432","title":"MinIO Information Disclosure Vulnerability","description":"MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure.","cwes":["CWE-200"],"kev":{"date_added":"2023-04-21","due_date":"2023-05-12","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-28432","description":"Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY`\nand `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.","status":"published","published":"2023-03-22T21:15:18.257Z","modified":"2026-06-17T05:47:42.203Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:07:50.908252Z"}],"osv":[{"id":"CVE-2023-28432","title":"Minio Information Disclosure in Cluster Deployment","description":"Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY`\nand `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.","status":"published","published":"2023-03-22T20:16:38.641Z","modified":"2026-10-28T02:31:11.735510604Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:31.468318Z"}]}}