Medium severity · published Dec 8, 2020
CVE-2020-25677
A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions. This flaw allows any user on the system to read sensitive information within this file. The highest threat from this vulnerability is to confidentiality.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Ceph Storage · Redhat
3.0; 4.0 · source: NVD
CE
Ceph-ansible · Ceph
4.0.41 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25677
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25677
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1892108
More from Ceph-ansible
8.8
CVE-2020-1716
A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services