Vulnerability in Ceph Ceph-Ansible
CVE-2020-1716
A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.013 (68.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 69th percentile — 68.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000
Affected products
- Ceph Ceph-Ansible
- Ceph-Ansible — versions ceph-ansible 6.0.0alpha1
Weakness classification (CWE)
References
- bugzilla.redhat.com/show_bug.cgi (Exploit, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-1716?
- CVE-2020-1716 is a high-severity vulnerability in Ceph Ceph-Ansible, classified under Use of Hard-coded Credentials. CVSS score: 8.8/10. Published 2021-05-28.
- How severe is CVE-2020-1716?
- High severity. CVSS v3 base score is 8.8 out of 10.