High severity · published Apr 21, 2020
CVE-2020-1699
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0
7.5
CVSS
2.1%
EPSS
No
On KEV
Description
A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Ceph · Linuxfoundation
14.2.5; 14.2.6; 15.0.0 · source: NVD
CS
Ceph Storage · Redhat
4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1699
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1699
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1699
More from Ceph
9.1
CVE-2022-0670
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system
8.0
CVE-2020-10736
An authorization bypass vulnerability was found in Ceph versions 15.2.0 before 15.2.2, where the ceph-mon and ceph-mgr daemons do not properly restrict access, resulting in…
7.5
CVE-2020-12059
An issue was discovered in Ceph through 13.2.9
7.2
CVE-2021-20288
An authentication flaw was found in ceph in versions before 14.2.20
6.8
CVE-2020-1759
A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the…