High severity · published Jun 22, 2020
CVE-2020-10736
An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr daemons do not properly restrict access, resulting in…
8.0
CVSS
0.6%
EPSS
No
On KEV
Description
An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr daemons do not properly restrict access, resulting in gaining access to unauthorized resources. This flaw allows an authenticated client to modify the configuration and possibly conduct further attacks.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Ceph · Linuxfoundation
15.2.0 before 15.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10736
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10736
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10736
Release Notes
https://ceph.io/releases/v15-2-2-octopus-released/
More from Ceph
9.1
CVE-2022-0670
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system
7.5
CVE-2020-12059
An issue was discovered in Ceph through 13.2.9
7.5
CVE-2020-1699
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0
7.2
CVE-2021-20288
An authentication flaw was found in ceph in versions before 14.2.20
6.8
CVE-2020-1759
A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the…