Skip to content

feature: minio - CVE-2024-24747 - improper privilege inheritance in access key creation #122

@hyde-repo

Description

@hyde-repo

Add CVE‑2024‑24747 to the inventory.

When creating a new MinIO access key, it incorrectly inherits admin:* permissions from its parent key even if only limited s3: rights were intended. This flaw enables privilege escalation by a user to gain full control of the MinIO deployment.

Section: ctf/storage/minio/
Type: privilege escalation / improper privilege management

Metadata

Metadata

Assignees

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions