NVD disclosure day
CVE-2023-28434
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The Minio object storage framework has a vulnerability allowing unauthorized object placement into any bucket via crafted requests. This impacts organizations with affected versions and requires specific credentials and Console API access for exploitation, posing a risk to data integrity.
CVE-2023-28432
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
MinIO cluster deployments can disclose sensitive environment variables, including access keys and passwords. This information disclosure presents a business risk by potentially compromising data and systems. Organizations are advised to update affected MinIO instances.
CVE-2023-0386
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A Linux kernel flaw in OverlayFS allows local users to escalate privileges by copying capable files between mounts. This impacts system integrity and data security. The realistic business risk involves unauthorized administrative control.