4.3

CVSS Score

3.1

Basic Information

CVE ID

CVE-2023-33955

GHSA ID

GHSA-jv3f-7m33-qp65

EPSS Score

0.49923%

CWE

CWE-200

Published

5/26/2023

Updated

11/12/2023

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-33955

CVE-2023-33955:
Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited

Impact

Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename.

Reported-By

Thanks to the report from Mio Li wulilixi1@gmail.com

Patches

commit 17e791afb90c9ad27c65f63c6be14f2f6a3a9d60
Author: Daniel Valdivia <18384552+dvaldivia@users.noreply.github.com>
Date:   Tue May 23 08:47:12 2023 -0700

    Replace RIGHT-TO-LEFT OVERRIDE unicode (#2828)
    
    Signed-off-by: Daniel Valdivia <18384552+dvaldivia@users.noreply.github.com>

Workarounds

Workarounds are to remove the concerned file and rewrite it properly with the right file and extensions. Avoid using RTLO characters in your filenames.

(GitHub Advisory)

4.3

CVSS Score

3.1

Basic Information

CVE ID

CVE-2023-33955

GHSA ID

GHSA-jv3f-7m33-qp65

EPSS Score

0.49923%

CWE

CWE-200

Published

5/26/2023

Updated

11/12/2023

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/minio/console	go	< 0.28.0	0.28.0

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

WAF Protection Rules

WAF Rule

### Imp**t Uni*o** RI**T-TO-L**T OV*RRI** ***r**t*rs **n ** us** to m*sk t** ori*in*l *il*n*m*. ### R*port**-*y T**nks to t** r*port *rom Mio Li [wulilixi*@*m*il.*om](m*ilto:wulilixi*@*m*il.*om) ### P*t***s ``` *ommit ******************************

Reasoning

No *n*lysis *v*il**l*

4.3

Basic Information

Concerned about an active attack path?

CVE-2023-33955: Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited

Impact

Reported-By

Patches

Workarounds

4.3

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

CVE-2023-33955:
Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited

Vulnerability Intelligence
Miggo AI