CVE-2022-24842

    Dashboard / Vulnerabilities / CVE-2022-24842

    CVE-2022-24842

    Published: 12 Apr 2022Last Modified: 12 Aug 2026

    Summary: Improper Privilege Management in MinIO

    Details: MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials. This in turn allows the user to escalate privilege to that of the root user. This vulnerability has been resolved in pull request #14729 and is included in `RELEASE.2022-04-12T06-55-35Z`. Users unable to upgrade may workaround this issue by explicitly adding a `admin:CreateServiceAccount` deny policy, however, this, in turn, denies the user the ability to create their own service accounts as well.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24842.json, https://github.com/minio/minio/security/advisories/GHSA-2j69-jjmg-534q, https://nvd.nist.gov/vuln/detail/CVE-2022-24842, https://github.com/minio/minio/commit/66b14a0d32684d527ae8018dc6d9d46ccce58ae3, https://github.com/minio/minio/pull/14729

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 83e8da57b8489f700436769488c139bcd0bc6f6e
    Fixed -e162a055cc29feedfb20e1be1f5402571cb36100

    Affected versions

    RELEASE.2022-04-09T15-09-52Z

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24842 | CVE-DB