CVE-2025-59952 (CNNVD-202509-4548)
中文标题:
MinIO Java SDK 代码注入漏洞
英文标题:
minio-java Client XML Tag is Vulnerable to Value Substitution
漏洞描述
中文描述:
MinIO Java SDK是MinIO开源的一个Java版MinIO客户端的开发者工具。 MinIO Java SDK 8.6.0之前版本存在代码注入漏洞，该漏洞源于XML标签值自动替换系统属性或环境变量，可能导致敏感信息泄露。
英文描述:
MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically substituted with their actual values during processing. This unintended behavior could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details, if such references were present in XML content from untrusted sources. This is fixed in version 8.6.0.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| minio | minio-java | < 8.6.0 | - | - |
cpe:2.3:a:minio:minio-java:<_8.6.0:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
4.0 (cna)
HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-59952 |
2025-11-11 15:23:31 | 2025-11-11 07:40:47 |
| NVD | nvd_CVE-2025-59952 |
2025-11-11 15:01:04 | 2025-11-11 07:48:34 |
| CNNVD | cnnvd_CNNVD-202509-4548 |
2025-11-11 15:12:59 | 2025-11-11 08:00:14 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 代码注入
- cnnvd_id: 未提取 -> CNNVD-202509-4548
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']