CyberRota Analysis
AI-GeneratedIn versions 4.08 through 4.33 of SeaweedFS, a vulnerability exists in the S3Tables management API that allows authenticated low-privileged S3 users to enumerate administrator-owned table bucket names and ARNs due to improper authorization handling. This flaw poses a risk of information disclosure, potentially enabling unauthorized access to sensitive data. Organizations using affected versions should prioritize upgrading to version 4.34 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SeaweedFS is a distributed storage system. In versions 4.08 through 4.33, requests signed with SigV4 service s3tables are routed to the S3Tables management API where authorization collapses account-less S3 identities into the shared admin account and fails open, allowing an authenticated low-privileged S3 user to enumerate administrator-owned table bucket names and ARNs. This issue is fixed in version 4.34.