CVE-2022-24842— Improper Privilege Management in MinIO
Quick assessment
Affected
minio minio
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MinIO是美国MinIO公司的一款开源的对象存储服务器。该产品支持构建用于机器学习、分析和应用程序数据工作负载的基础架构。 MinIO 存在安全漏洞，该漏洞源于非管理员用户能够为 root 或其他管理员用户创建服务帐户，然后能够通过生成的凭据假设他们的访问策略。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-24842
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Privilege Management in MinIO
Source: CVE Program / CVE List V5
Vulnerability Description
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials. This in turn allows the user to escalate privilege to that of the root user. This vulnerability has been resolved in pull request #14729 and is included in `RELEASE.2022-04-12T06-55-35Z`. Users unable to upgrade may workaround this issue by explicitly adding a `admin:CreateServiceAccount` deny policy, however, this, in turn, denies the user the ability to create their own service accounts as well.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
MinIO 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MinIO是美国MinIO公司的一款开源的对象存储服务器。该产品支持构建用于机器学习、分析和应用程序数据工作负载的基础架构。 MinIO 存在安全漏洞，该漏洞源于非管理员用户能够为 root 或其他管理员用户创建服务帐户，然后能够通过生成的凭据假设他们的访问策略。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-24842
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-24842
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-24842 (2)
-
https://github.com/minio/minio/pull/14729 x_refsource_MISC
Vendor Advisories for CVE-2022-24842 (1)
-
https://github.com/minio/minio/security/advisories/GHSA-2j69-jjmg-534q x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: minio
-
CVE-2026-97731
MinIO<7aac2a2越权复制漏洞 -
CVE-2026-42600
MinIO: Path Traversal via msgpack Body in `ReadMultiple` Sto -
CVE-2026-41145
MinIO has an Unauthenticated Object Write via Query-String C -
CVE-2026-40344
MinIO has an Unauthenticated Object Write via Missing Signat -
CVE-2026-39414
MinIO affected a DoS via Unbounded Memory Allocation in S3 S
Same vendor: minio
-
CVE-2026-97731
MinIO<7aac2a2越权复制漏洞 -
CVE-2026-42600
MinIO: Path Traversal via msgpack Body in `ReadMultiple` Sto -
CVE-2026-41145
MinIO has an Unauthenticated Object Write via Query-String C -
CVE-2026-40344
MinIO has an Unauthenticated Object Write via Missing Signat -
CVE-2026-39414
MinIO affected a DoS via Unbounded Memory Allocation in S3 S
Same weakness: CWE-269
-
CVE-2026-109143
calcom cal.com/cal.diy Credentials delete credentials.delete -
CVE-2026-18343
IBM i is Affected By An Improper Privilege Management Vulner -
CVE-2026-109667
Frappe ERPNext before 15.111.0 Privilege Escalation via Unau -
CVE-2024-58390
Frappe before 15.41.0 Privilege Escalation via Document Acti -
CVE-2026-18513
IBM Maximo Application Suite - Location Service for Esri Com
V. Comments for CVE-2022-24842
No comments yet