CVE-2023-28434

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c", "name": "https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c", "tags": [], "refsource": "MISC"}, {"url": "https://github.com/minio/minio/pull/16849", "name": "https://github.com/minio/minio/pull/16849", "tags": [], "refsource": "MISC"}, {"url": "https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5", "name": "https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5", "tags": [], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-269"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2023-28434", "ASSIGNER": "security-advisories@github.com"}}, "impact": {}, "publishedDate": "2023-03-22T21:15Z", "configurations": {"nodes": [], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-03-22T21:15Z"}