CVE-2024-36107

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` and `If-Unmodified-Since` headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a specific bucket and also gain access to some amount of information such as `Last-Modified (of the latest version)`, `Etag (of the latest version)`, `x-amz-version-id (of the latest version)`, `Expires (metadata value of the latest version)`, `Cache-Control (metadata value of the latest version)`. This conditional check was being honored before validating if the anonymous access is indeed allowed on the metadata of an object. This issue has been addressed in commit `e0fe7cc3917`. Users must upgrade to RELEASE.2024-05-27T19-17-46Z for the fix. There are no known workarounds for this issue.

• CWE-200

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Modified-Since
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Unmodified-Since
• https://github.com/minio/minio/commit/e0fe7cc391724fc5baa85b45508f425020fe4272
• https://github.com/minio/minio/pull/19810
• https://github.com/minio/minio/security/advisories/GHSA-95fr-cm4m-q5p9
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Modified-Since
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Unmodified-Since
• https://github.com/minio/minio/commit/e0fe7cc391724fc5baa85b45508f425020fe4272
• https://github.com/minio/minio/pull/19810
• https://github.com/minio/minio/security/advisories/GHSA-95fr-cm4m-q5p9

Published

May 28, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3609The ReviewX – Multi-criteria Rating & Reviews for WooCommerc…4.3
• CVE-2024-3610The WP Child Theme Generator plugin for WordPress is vulnera…5.3
• CVE-2024-36103OS command injection vulnerability in WRC-X5400GS-B v1.0.10 …6.8
• CVE-2024-36104Improper Limitation of a Pathname to a Restricted Directory …9.1
• CVE-2024-36105dbt enables data analysts and engineers to transform their d…5.3
• CVE-2024-36106Argo CD is a declarative, GitOps continuous delivery tool fo…4.3
• CVE-2024-36108casgate is an Open Source Identity and Access Management sys…9.8
• CVE-2024-36109CoCalc is web-based software that enables collaboration in r…7.6
• CVE-2024-3611The Toolbar Extras for Elementor & More – WordPress Admin Ba…6.4
• CVE-2024-36110ansibleguy-webui is an open source WebUI for using Ansible. …8.2
• CVE-2024-36111KubePi is a K8s panel. Starting in version 1.6.3 and prior t…6.3
• CVE-2024-36112Nautobot is a Network Source of Truth and Network Automation…6.5