-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/minio/minio | go | < 0.0.0-20240527191746-e0fe7cc39172 | 0.0.0-20240527191746-e0fe7cc39172 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from the order of operations in the GET request handler. The commit e0fe7cc moved authorization checks before precondition validation. In the original code (visible in the cmd/object-handlers.go diff), the flow was: check preconditions -> set UserTags -> authorize. The fixed version does: set UserTags -> authorize -> check preconditions. This ensures metadata isn't disclosed during precondition checks for unauthorized requests.